CVE-2026-8384: CWE-647 in Eclipse Foundation Eclipse Jetty
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
AI Analysis
Technical Summary
The vulnerability involves Eclipse Jetty incorrectly handling HTTP URIs with semicolon path parameters, resulting in unresolved paths such as '/public/../admin/secret.txt' instead of the expected resolved path '/admin/secret.txt'. Jetty's internal alias checker prevents serving unauthorized files like 'secret.txt', so Jetty itself is not directly vulnerable. However, web applications that depend on Jetty to provide resolved paths may be confused by receiving unresolved paths, potentially leading to logic errors or security issues in those applications. The affected versions include 12.0.0, 12.1.0, and all versions from 12.0.0 up to 12.0.34 and from 12.1.0 up to 12.1.8.
Potential Impact
Jetty does not serve unauthorized files due to its alias checking, so there is no direct file disclosure or data confidentiality impact from this vulnerability. The impact is limited to web applications that rely on Jetty's path resolution to enforce security or access control. These applications may be misled by unresolved paths, potentially causing incorrect access decisions or other logic errors. There is no indication of known exploits in the wild.
Mitigation Recommendations
No official fix or patch is currently indicated. Since Jetty itself prevents serving unauthorized files, the primary mitigation is for web application developers to not rely solely on Jetty's path resolution for security decisions. They should implement their own robust path normalization and validation. Monitor the vendor advisory for updates or patches addressing this issue.
CVE-2026-8384: CWE-647 in Eclipse Foundation Eclipse Jetty
Description
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
CVSS v3.1
Score 5.3medium
Affected software
pkg:github/Eclipse JettyRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
Weaknesses
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
The vulnerability involves Eclipse Jetty incorrectly handling HTTP URIs with semicolon path parameters, resulting in unresolved paths such as '/public/../admin/secret.txt' instead of the expected resolved path '/admin/secret.txt'. Jetty's internal alias checker prevents serving unauthorized files like 'secret.txt', so Jetty itself is not directly vulnerable. However, web applications that depend on Jetty to provide resolved paths may be confused by receiving unresolved paths, potentially leading to logic errors or security issues in those applications. The affected versions include 12.0.0, 12.1.0, and all versions from 12.0.0 up to 12.0.34 and from 12.1.0 up to 12.1.8.
Potential Impact
Jetty does not serve unauthorized files due to its alias checking, so there is no direct file disclosure or data confidentiality impact from this vulnerability. The impact is limited to web applications that rely on Jetty's path resolution to enforce security or access control. These applications may be misled by unresolved paths, potentially causing incorrect access decisions or other logic errors. There is no indication of known exploits in the wild.
Mitigation Recommendations
No official fix or patch is currently indicated. Since Jetty itself prevents serving unauthorized files, the primary mitigation is for web application developers to not rely solely on Jetty's path resolution for security decisions. They should implement their own robust path normalization and validation. Monitor the vendor advisory for updates or patches addressing this issue.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-05-12T10:01:35.472Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Remediation Level
- null
Threat ID: 6a55feea68715ace432dfb96
Added to database: 07/14/2026, 09:18:34 UTC
Last enriched: 07/14/2026, 10:02:57 UTC
Last updated: 07/14/2026, 23:04:50 UTC
Views: 10
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
External Links
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.