Threats affecting pkg:maven/org.eclipse.jetty/jetty

CVE-2026-76182 is a medium severity vulnerability in Eclipse Jetty where the TryPathsHandler and TryFilesFilter components improperly handle URI path characters when forwarding requests to template URIs. This causes reserved characters in URI queries to be misinterpreted as multiple query parameters instead of a single parameter value.

CVE-2026-19204 is a high-severity vulnerability in Eclipse Jetty where a client can send a WebSocket frame with an unknown opcode and a very large declared payload length. This causes Jetty to allocate a large amount of memory, potentially exhausting the JVM heap. The issue arises when auto-fragmentation is enabled, as unknown opcodes bypass normal frame size checks and payload allocation happens before opcode validation.

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.