DeutschShown in its original language — a full translation is planned for a future version.
Eclipse Jetty: Mehrere Schwachstellen
view advisory published 2026-10-15
Ein Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um Dateien zu manipulieren, um Informationen offenzulegen und um Sicherheitsvorkehrungen zu umgehen.
01
describes (7)
Related CVEs.
| ID | severity | exploitable | ||
|---|---|---|---|---|
| CVE-2026-19864US | —OT elevated | — | ||
Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session… | ||||
| CVE-2026-18662US | —OT elevated | — | ||
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-pattern… | ||||
| CVE-2026-18660US | — | — | ||
In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by ca… | ||||
| CVE-2026-18659US | —OT elevated | — | ||
In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can… | ||||
| CVE-2026-77711US | — | — | ||
When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).
The client mistakenly interprets t… | ||||
| CVE-2026-76184US | — | — | ||
In Eclipse Jetty, HttpClient may receive a redirect of the form:
```
/secure/../evil
```
If an attacker is able to control the redirects, then HttpClient matches authen… | ||||
| CVE-2026-18661US | —OT elevated | — | ||
In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotat… | ||||
02
references
External citations — patches, advisories, analysis.
- Jetty Security Advisory vom 2026-10-15external
- Jetty Security Advisory vom 2026-10-15external
- Jetty Security Advisory vom 2026-10-15external
- Jetty Security Advisory vom 2026-10-15external
- Jetty Security Advisory vom 2026-10-15external
- Jetty Security Advisory vom 2026-10-15external
- Jetty Security Advisory vom 2026-10-15external
- WID-SEC-W-2026-3992 - CSAF Versionself
scry
Advisories like this name the exposed products attackers go after on your perimeter. See what is exposed on your perimeter with a free passive scan.
Free scan