CVE-2026-76182

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76182", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-08-19T10:37:18.662Z", "datePublished": "2026-10-15T08:40:58.439Z", "dateUpdated": "2026-10-15T13:59:12.521Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-10-15T08:40:58.439Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-74", "description": "CWE-74", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.ee10:jetty-ee10-fcgi-proxy", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.ee11:jetty-ee11-fcgi-proxy", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.ee8:jetty-ee8-fcgi-proxy", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.ee9:jetty-ee9-fcgi-proxy", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.fcgi:fcgi-server", "versions": [{"status": "affected", "version": "11.0.0", "lessThanOrEqual": "11.0.32", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThanOrEqual": "10.0.32", "versionType": "semver"}, {"status": "affected", "version": "9.4.0", "lessThanOrEqual": "9.4.64", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty:jetty-server", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.\n\n\n\nHowever, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.</p><p>However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&amp;a=1` when applied to the template becomes `index?p=/s&amp;a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&amp;a=1`.</p>"}]}], "references": [{"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/237"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "https://github.com/4ra1n", "type": "finder"}, {"lang": "en", "value": "https://github.com/pyn3rd", "type": "finder"}, {"lang": "en", "value": "https://github.com/unam4", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"references": [{"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m", "tags": ["exploit"]}], "metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-10-15T13:58:50.649742Z", "id": "CVE-2026-76182", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T13:59:12.521Z"}}]}}

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-76182", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-08-19T10:37:18.662Z", "datePublished": "2026-10-15T08:40:58.439Z", "dateUpdated": "2026-10-15T13:59:12.521Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-10-15T08:40:58.439Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-74", "description": "CWE-74", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.ee10:jetty-ee10-fcgi-proxy", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.ee11:jetty-ee11-fcgi-proxy", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.ee8:jetty-ee8-fcgi-proxy", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.ee9:jetty-ee9-fcgi-proxy", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty.fcgi:fcgi-server", "versions": [{"status": "affected", "version": "11.0.0", "lessThanOrEqual": "11.0.32", "versionType": "semver"}, {"status": "affected", "version": "10.0.0", "lessThanOrEqual": "10.0.32", "versionType": "semver"}, {"status": "affected", "version": "9.4.0", "lessThanOrEqual": "9.4.64", "versionType": "semver"}], "defaultStatus": "unaffected"}, {"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "packageName": "org.eclipse.jetty:jetty-server", "versions": [{"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.12", "versionType": "semver"}, {"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.38", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.\n\n\n\nHowever, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.</p><p>However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&amp;a=1` when applied to the template becomes `index?p=/s&amp;a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&amp;a=1`.</p>"}]}], "references": [{"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m"}, {"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/237"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV4_0": {"attackVector": "NETWORK", "attackComplexity": "LOW", "attackRequirements": "NONE", "privilegesRequired": "NONE", "userInteraction": "NONE", "vulnConfidentialityImpact": "NONE", "subConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "subIntegrityImpact": "NONE", "vulnAvailabilityImpact": "NONE", "subAvailabilityImpact": "NONE", "exploitMaturity": "NOT_DEFINED", "Safety": "NOT_DEFINED", "Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "valueDensity": "NOT_DEFINED", "vulnerabilityResponseEffort": "NOT_DEFINED", "providerUrgency": "NOT_DEFINED", "version": "4.0", "baseSeverity": "MEDIUM", "baseScore": 6.9, "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N"}}], "credits": [{"lang": "en", "value": "https://github.com/4ra1n", "type": "finder"}, {"lang": "en", "value": "https://github.com/pyn3rd", "type": "finder"}, {"lang": "en", "value": "https://github.com/unam4", "type": "finder"}], "source": {"discovery": "UNKNOWN"}, "x_generator": {"engine": "Vulnogram 1.0.5"}}, "adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-76182", "role": "CISA Coordinator", "options": [{"Exploitation": "poc"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-10-15T13:58:50.649742Z"}}}], "references": [{"url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m", "tags": ["exploit"]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-10-15T13:59:07.751Z"}}]}}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "packageName": "org.eclipse.jetty.ee10:jetty-ee10-fcgi-proxy", "product": "Eclipse Jetty", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "12.1.12", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.0.38", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "org.eclipse.jetty.ee11:jetty-ee11-fcgi-proxy", "product": "Eclipse Jetty", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "12.1.12", "status": "affected", "version": "12.1.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "org.eclipse.jetty.ee8:jetty-ee8-fcgi-proxy", "product": "Eclipse Jetty", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "12.1.12", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.0.38", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "org.eclipse.jetty.ee9:jetty-ee9-fcgi-proxy", "product": "Eclipse Jetty", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "12.1.12", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.0.38", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "org.eclipse.jetty.fcgi:fcgi-server", "product": "Eclipse Jetty", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "11.0.32", "status": "affected", "version": "11.0.0", "versionType": "semver"}, {"lessThanOrEqual": "10.0.32", "status": "affected", "version": "10.0.0", "versionType": "semver"}, {"lessThanOrEqual": "9.4.64", "status": "affected", "version": "9.4.0", "versionType": "semver"}]}, {"defaultStatus": "unaffected", "packageName": "org.eclipse.jetty:jetty-server", "product": "Eclipse Jetty", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "12.1.12", "status": "affected", "version": "12.1.0", "versionType": "semver"}, {"lessThanOrEqual": "12.0.38", "status": "affected", "version": "12.0.0", "versionType": "semver"}]}], "source": "emo@eclipse.org"}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.\n\n\n\nHowever, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`."}], "id": "CVE-2026-76182", "lastModified": "2026-10-15T14:41:34.110", "metrics": {"cvssMetricV40": [{"cvssData": {"Automatable": "NOT_DEFINED", "Recovery": "NOT_DEFINED", "Safety": "NOT_DEFINED", "attackComplexity": "LOW", "attackRequirements": "NONE", "attackVector": "NETWORK", "availabilityRequirement": "NOT_DEFINED", "baseScore": 6.9, "baseSeverity": "MEDIUM", "confidentialityRequirement": "NOT_DEFINED", "exploitMaturity": "NOT_DEFINED", "integrityRequirement": "NOT_DEFINED", "modifiedAttackComplexity": "NOT_DEFINED", "modifiedAttackRequirements": "NOT_DEFINED", "modifiedAttackVector": "NOT_DEFINED", "modifiedPrivilegesRequired": "NOT_DEFINED", "modifiedSubAvailabilityImpact": "NOT_DEFINED", "modifiedSubConfidentialityImpact": "NOT_DEFINED", "modifiedSubIntegrityImpact": "NOT_DEFINED", "modifiedUserInteraction": "NOT_DEFINED", "modifiedVulnAvailabilityImpact": "NOT_DEFINED", "modifiedVulnConfidentialityImpact": "NOT_DEFINED", "modifiedVulnIntegrityImpact": "NOT_DEFINED", "privilegesRequired": "NONE", "providerUrgency": "NOT_DEFINED", "subAvailabilityImpact": "NONE", "subConfidentialityImpact": "NONE", "subIntegrityImpact": "NONE", "userInteraction": "NONE", "valueDensity": "NOT_DEFINED", "vectorString": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X", "version": "4.0", "vulnAvailabilityImpact": "NONE", "vulnConfidentialityImpact": "NONE", "vulnIntegrityImpact": "LOW", "vulnerabilityResponseEffort": "NOT_DEFINED"}, "source": "emo@eclipse.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-76182", "options": [{"exploitation": "poc"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-10-15T13:58:50.649742Z", "version": "2.0.3"}}]}, "published": "2026-10-15T09:17:18.300", "references": [{"source": "emo@eclipse.org", "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m"}, {"source": "emo@eclipse.org", "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/237"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Awaiting Analysis", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-74"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{"bugzilla": {"description": "org.eclipse.jetty/jetty-server: org.eclipse.jetty.ee10/jetty-ee10-servlets: org.eclipse.jetty.ee9/jetty-ee9-servlets: org.eclipse.jetty.ee8/jetty-ee8-servlets: Eclipse Jetty: Query parameter injection via unescaped URI paths", "id": "2553117", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2553117"}, "csaw": false, "cvss3": {"cvss3_base_score": "5.3", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "status": "draft"}, "cwe": "CWE-140", "details": ["A flaw was found in Eclipse Jetty. When configured to forward requests to template Uniform Resource Identifiers (URIs) using TryPathsHandler or TryFilesFilter, path values are not properly encoded before substitution into query strings. A remote attacker can exploit this flaw by sending requests containing reserved URI characters, resulting in query parameter injection that may alter application behavior and compromise data integrity."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.\nFixed in: No fixed version identified yet..\nRed Hat recommends updating org.eclipse.jetty/jetty-server, org.eclipse.jetty.ee10/jetty-ee10-servlets, org.eclipse.jetty.ee9/jetty-ee9-servlets, org.eclipse.jetty.ee8/jetty-ee8-servlets to the latest version when a fix is available."}, "name": "CVE-2026-76182", "package_state": [{"cpe": "cpe:/a:redhat:exploit_intelligence:0", "fix_state": "Out of support scope", "package_name": "exploit-intelligence/agent-client-rhel9", "product_name": "Exploit Intelligence"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Out of support scope", "package_name": "jenkins", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Out of support scope", "package_name": "ocp-tools-4/jenkins-rhel8", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:ocp_tools", "fix_state": "Out of support scope", "package_name": "ocp-tools-4/jenkins-rhel9", "product_name": "OpenShift Developer Tools and Services"}, {"cpe": "cpe:/a:redhat:amq_broker:7", "fix_state": "Fix deferred", "package_name": "jetty-server", "product_name": "Red Hat AMQ Broker 7"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "jetty-ee10-servlets", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "jetty-ee8-servlets", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "jetty-ee9-servlets", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:camel_spring_boot:4", "fix_state": "Fix deferred", "package_name": "jetty-server", "product_name": "Red Hat build of Apache Camel for Spring Boot 4"}, {"cpe": "cpe:/a:redhat:apache_camel_hawtio:4", "fix_state": "Fix deferred", "package_name": "jetty-server", "product_name": "Red Hat build of Apache Camel - HawtIO 4"}, {"cpe": "cpe:/a:redhat:apicurio_registry:3", "fix_state": "Fix deferred", "package_name": "jetty-server", "product_name": "Red Hat build of Apicurio Registry 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "jetty-ee10-servlets", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/a:redhat:debezium:3", "fix_state": "Fix deferred", "package_name": "jetty-server", "product_name": "Red Hat build of Debezium 3"}, {"cpe": "cpe:/o:redhat:enterprise_linux:10", "fix_state": "Not affected", "package_name": "jsoup", "product_name": "Red Hat Enterprise Linux 10"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "maven-site-plugin", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "pki-core:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "pki-deps:10.6/resteasy", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "jackson-jaxrs-providers", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "jmc", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "jsoup", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "maven:3.9/maven-resolver", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "maven-resolver", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "resteasy", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:jboss_fuse:7", "fix_state": "Out of support scope", "package_name": "jetty-server", "product_name": "Red Hat Fuse 7"}, {"cpe": "cpe:/a:redhat:offline_knowledge_portal:1", "fix_state": "Out of support scope", "package_name": "offline-knowledge-portal/rhokp-rhel9", "product_name": "Red Hat Offline Knowledge Portal"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-spark-operator-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-cpu-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-cpu-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-cuda130-torch210-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-cuda130-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th06-rocm64-torch291-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th-torch-cpu-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_ai", "fix_state": "Not affected", "package_name": "rhoai/odh-th-torch-cuda-py312-rhel9", "product_name": "Red Hat OpenShift AI (RHOAI)"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/openvsx-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:openshift_devspaces:3", "fix_state": "Not affected", "package_name": "devspaces/pluginregistry-rhel9", "product_name": "Red Hat OpenShift Dev Spaces"}, {"cpe": "cpe:/a:redhat:satellite:6", "fix_state": "Not affected", "package_name": "openvox-server", "product_name": "Red Hat Satellite 6"}], "public_date": "2026-10-15T08:40:58Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2026-76182\nhttps://nvd.nist.gov/vuln/detail/CVE-2026-76182\nhttps://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m\nhttps://gitlab.eclipse.org/security/cve-assignment/-/work_items/237"], "statement": "A flaw was found in org.eclipse.jetty/jetty-server, org.eclipse.jetty.ee10/jetty-ee10-servlets, org.eclipse.jetty.ee9/jetty-ee9-servlets, org.eclipse.jetty.ee8/jetty-ee8-servlets. In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.\nHowever, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.\nPrerequisites: Standard deployment configuration\nCVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). None -- NVD score appropriate\nExploitation scenario: No exploitation steps identified. Exploitation difficulty: MEDIUM.\nThis issue affects amq-7, exploit-intelligence, fedora-all, fuse-7, ocp-tools-4, offline-knowledge-portal-1, openshift-ai, openshift-hosted-osd4, rhboac-hawtio-4, rhel-10, rhel-7, rhel-8, rhel-9, rhel-br-10, rhel-br-8, rhel-br-9, rhint-camel-spring-boot-4, rhint-debezium-3, rhint-serv-3, rhivos-2, rhivos-core-2, rhn_satellite_6, rhos_devspaces-3, services-management-platform, services-remediations-platform. Red Hat has rated this as having moderate impact.", "threat_severity": "Moderate"}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.0,12.1.12]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.0.38]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Eclipse Jetty", "source": "cna", "vendor": "Eclipse Foundation"}, "product": "jetty", "vendor": "eclipse"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.0,12.1.12]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Eclipse Jetty", "source": "cna", "vendor": "Eclipse Foundation"}, "product": "jetty", "vendor": "eclipse"}, {"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[11.0.0,11.0.32]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[10.0.0,10.0.32]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[9.4.0,9.4.64]"}}], "enrichment": {"confidence": 100.0, "confidence_source": "manual", "scores": [{"score": 100.0, "source": "manual"}]}, "original": {"product": "Eclipse Jetty", "source": "cna", "vendor": "Eclipse Foundation"}, "product": "jetty", "vendor": "eclipse"}], "created": "2026-10-16T22:00:16.310286+00:00", "updated": "2026-10-19T14:01:48.702412+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$jetty"]}