CVE catalog

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/se

[CVE catalog]

Severity: Medium · CVSS 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Published: Jul 13, 2026, 10:00:00 PM UTC
Source: [NVD] · [CVE record]
EPSS: 0.33% · Oct 25, 2026

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	jetty9	sid	`9.4.58-2`	vulnerable
Debian	jetty9	forky	`9.4.58-2`	vulnerable
Debian	jetty9	trixie	`9.4.57-1.1~deb13u1`	vulnerable
Debian	jetty9	trixie-security	`9.4.57-1.1~deb13u1`	vulnerable
Debian	jetty9	bookworm	`9.4.57-1.1~deb12u1`	vulnerable
Debian	jetty9	bookworm-security	`9.4.57-1.1~deb12u1`	vulnerable
Cpe	jetty9	Not reported	Not reported	vulnerable
Maven	org.eclipse.jetty:jetty-util	Not reported	`12.0.35`	fixed
Maven	org.eclipse.jetty:jetty-util	Not reported	`12.1.9`	fixed
Cpe	jetty	Not reported	`12.1.9`	fixed

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	jetty9	source	sid	`(unfixed)`	not yet assigned	Not reported	[1151846]
Debian	jetty9	source	forky	`(unfixed)`	not yet assigned	Not reported	[1151846]
Debian	jetty9	source	trixie	`(unfixed)`	not yet assigned	Not reported	[1151846]
Debian	jetty9	source	bookworm	`(unfixed)`	not yet assigned	Not reported	[1151846]
Maven	org.eclipse.jetty:jetty-util	maven	Not reported	`12.0.35`	Not reported	Not reported	Not reported
Maven	org.eclipse.jetty:jetty-util	maven	Not reported	`12.1.9`	Not reported	Not reported	Not reported
Cpe	jetty	cpe	Not reported	`12.1.9`	Not reported	NVD-CVE-2026-8384	Not reported

[Debian bug #1151846]

OpenFactory catalog packages

[Debian 12 (Bookworm)]

[jetty9]Affected
Details (4)
- 9.4.57-1.1~deb12u1 · all · bookworm
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
[libjetty9-extra-java]Affected
Source package: [jetty9]
Details (4)
- 9.4.57-1.1~deb12u1 · all · bookworm
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
[libjetty9-java]Affected
Source package: [jetty9]
Details (4)
- 9.4.57-1.1~deb12u1 · all · bookworm
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Affected
  nvd · jetty9 · debian · bookworm; nvd · jetty9 · debian · 12

[Debian 13 (Trixie)]

[jetty12]Affected
Details (4)
- 12.0.17-3.1~deb13u1 · all · trixie
  Affected
  nvd · jetty12 · debian · 13
- 12.0.17-3.1~deb13u1 · all · trixie
  Affected
  nvd · jetty12 · debian · 13
- 12.0.17-3.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty12 · debian · 13
- 12.0.17-3.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty12 · debian · 13
[jetty9]Affected
Details (4)
- 9.4.57-1.1~deb13u1 · all · trixie
  Affected
  nvd · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie
  Affected
  nvd · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty9 · debian · 13
[libjetty12-extra-java]Affected
Source package: [jetty12]
Details (4)
- 12.0.17-3.1~deb13u1 · all · trixie
  Affected
  nvd · jetty12 · debian · 13
- 12.0.17-3.1~deb13u1 · all · trixie
  Affected
  nvd · jetty12 · debian · 13
- 12.0.17-3.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty12 · debian · 13
- 12.0.17-3.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty12 · debian · 13
[libjetty12-java]Affected
Source package: [jetty12]
Details (4)
- 12.0.17-3.1~deb13u1 · all · trixie
  Affected
  nvd · jetty12 · debian · 13
- 12.0.17-3.1~deb13u1 · all · trixie
  Affected
  nvd · jetty12 · debian · 13
- 12.0.17-3.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty12 · debian · 13
- 12.0.17-3.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty12 · debian · 13
[libjetty9-extra-java]Affected
Source package: [jetty9]
Details (4)
- 9.4.57-1.1~deb13u1 · all · trixie
  Affected
  nvd · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie
  Affected
  nvd · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty9 · debian · 13
[libjetty9-java]Affected
Source package: [jetty9]
Details (4)
- 9.4.57-1.1~deb13u1 · all · trixie
  Affected
  nvd · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie
  Affected
  nvd · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Affected
  nvd · jetty9 · debian · 13

Observed: Oct 27, 2026, 7:13:07 AM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [GitHub Advisory Database] · [National Vulnerability Database (NVD)] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX]