CVE-2026-8384

{"dataType": "CVE_RECORD", "dataVersion": "5.2", "cveMetadata": {"cveId": "CVE-2026-8384", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "state": "PUBLISHED", "assignerShortName": "eclipse", "dateReserved": "2026-05-12T10:01:35.472Z", "datePublished": "2026-07-14T08:56:17.525Z", "dateUpdated": "2026-07-14T12:18:29.831Z"}, "containers": {"cna": {"providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-07-14T08:56:17.525Z"}, "problemTypes": [{"descriptions": [{"lang": "en", "cweId": "CWE-647", "description": "CWE-647", "type": "CWE"}]}], "affected": [{"vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "repo": "https://github.com/jetty/jetty.project", "versions": [{"status": "affected", "version": "12.0.0", "lessThanOrEqual": "12.0.34", "versionType": "semver"}, {"status": "affected", "version": "12.1.0", "lessThanOrEqual": "12.1.8", "versionType": "semver"}], "defaultStatus": "unaffected"}], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.", "supportingMedia": [{"type": "text/html", "base64": false, "value": "<p>In Eclipse Jetty, an HTTP URI of this form:</p>\n<div>\n<pre><code>/public;/../admin/secret.txt</code></pre>\n\n</div>\n<p>results in an unresolved path of:</p>\n<div>\n<pre><code>/public/../admin/secret.txt</code></pre>\n\n</div>\n<p>instead of the expected:</p>\n<div>\n<pre><code>/admin/secret.txt</code></pre>\n\n</div>\n<p>Jetty itself is not affected, as it will not serve the <code>secret.txt</code> file because it will not pass the alias checker (only resolved resources are served).</p>\n<p>However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.</p>"}]}], "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "attackVector": "NETWORK", "attackComplexity": "LOW", "privilegesRequired": "NONE", "userInteraction": "NONE", "scope": "UNCHANGED", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "availabilityImpact": "NONE", "baseSeverity": "MEDIUM", "baseScore": 5.3, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N"}}], "credits": [{"lang": "en", "value": "https://github.com/jweny", "type": "finder"}, {"lang": "en", "value": "https://github.com/lworld0x00", "type": "finder"}], "x_generator": {"engine": "Vulnogram 1.0.2"}}, "adp": [{"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2026-07-14T12:18:08.648859Z", "id": "CVE-2026-8384", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:18:29.831Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2026-8384", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "yes"}, {"Technical Impact": "partial"}], "version": "2.0.3", "timestamp": "2026-07-14T12:18:08.648859Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2026-07-14T12:18:16.867Z"}}], "cna": {"credits": [{"lang": "en", "type": "finder", "value": "https://github.com/jweny"}, {"lang": "en", "type": "finder", "value": "https://github.com/lworld0x00"}], "metrics": [{"format": "CVSS", "cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "integrityImpact": "LOW", "userInteraction": "NONE", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "scenarios": [{"lang": "en", "value": "GENERAL"}]}], "affected": [{"repo": "https://github.com/jetty/jetty.project", "vendor": "Eclipse Foundation", "product": "Eclipse Jetty", "versions": [{"status": "affected", "version": "12.0.0", "versionType": "semver", "lessThanOrEqual": "12.0.34"}, {"status": "affected", "version": "12.1.0", "versionType": "semver", "lessThanOrEqual": "12.1.8"}], "defaultStatus": "unaffected"}], "references": [{"url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108"}], "x_generator": {"engine": "Vulnogram 1.0.2"}, "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.", "supportingMedia": [{"type": "text/html", "value": "<p>In Eclipse Jetty, an HTTP URI of this form:</p>\n<div>\n<pre><code>/public;/../admin/secret.txt</code></pre>\n\n</div>\n<p>results in an unresolved path of:</p>\n<div>\n<pre><code>/public/../admin/secret.txt</code></pre>\n\n</div>\n<p>instead of the expected:</p>\n<div>\n<pre><code>/admin/secret.txt</code></pre>\n\n</div>\n<p>Jetty itself is not affected, as it will not serve the <code>secret.txt</code> file because it will not pass the alias checker (only resolved resources are served).</p>\n<p>However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.</p>", "base64": false}]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-647", "description": "CWE-647"}]}], "providerMetadata": {"orgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "shortName": "eclipse", "dateUpdated": "2026-07-14T08:56:17.525Z"}}}, "cveMetadata": {"cveId": "CVE-2026-8384", "state": "PUBLISHED", "dateUpdated": "2026-07-14T12:18:29.831Z", "dateReserved": "2026-05-12T10:01:35.472Z", "assignerOrgId": "e51fbebd-6053-4e49-959f-1b94eeb69a2c", "datePublished": "2026-07-14T08:56:17.525Z", "assignerShortName": "eclipse"}, "dataVersion": "5.2"}

{"affected": [{"affectedData": [{"defaultStatus": "unaffected", "product": "Eclipse Jetty", "repo": "https://github.com/jetty/jetty.project", "vendor": "Eclipse Foundation", "versions": [{"lessThanOrEqual": "12.0.34", "status": "affected", "version": "12.0.0", "versionType": "semver"}, {"lessThanOrEqual": "12.1.8", "status": "affected", "version": "12.1.0", "versionType": "semver"}]}], "source": "emo@eclipse.org"}], "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "655AA819-8D55-40C7-BCF3-F7D2AC085C41", "versionEndExcluding": "12.0.35", "versionStartIncluding": "12.0.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*", "matchCriteriaId": "FF2AE57E-99D5-4181-A5B6-77A5FFBEB3F1", "versionEndExcluding": "12.1.9", "versionStartIncluding": "12.1.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path."}, {"lang": "es", "value": "En Eclipse Jetty, una URI HTTP de esta forma:\n\n/public;/.. / admin/secret.txt\n\nresulta en una ruta no resuelta de:\n\n/public/.. / admin/secret.txt\n\nen lugar de la esperada:\n\n/admin/secret.txt\n\nJetty en s\u00ed no se ve afectado, ya que no servir\u00e1 el archivo secret.txt porque no pasar\u00e1 el verificador de alias (solo se sirven recursos resueltos).\n\nSin embargo, las aplicaciones web que dependen de que Jetty proporcione rutas resueltas pueden confundirse al recibir una ruta no resuelta."}], "id": "CVE-2026-8384", "lastModified": "2026-10-24T21:10:00.130", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "NONE", "baseScore": 5.3, "baseSeverity": "MEDIUM", "confidentialityImpact": "NONE", "integrityImpact": "LOW", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "version": "3.1"}, "exploitabilityScore": 3.9, "impactScore": 1.4, "source": "emo@eclipse.org", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2026-8384", "options": [{"exploitation": "none"}, {"automatable": "yes"}, {"technicalImpact": "partial"}], "role": "CISA Coordinator", "timestamp": "2026-07-14T12:18:08.648859Z", "version": "2.0.3"}}]}, "published": "2026-07-14T09:16:42.050", "references": [{"source": "emo@eclipse.org", "tags": ["Vendor Advisory", "Exploit"], "url": "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108"}], "sourceIdentifier": "emo@eclipse.org", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-647"}], "source": "emo@eclipse.org", "type": "Secondary"}]}

{}

{"affected": [{"configurations": [{"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.0.0,12.0.34]"}}, {"platform": null, "status": "affected", "versions": {"scheme": "semver", "value": "[12.1.0,12.1.8]"}}], "enrichment": {"confidence": 95.0, "confidence_source": "inferred", "scores": [{"score": 95.0, "source": "inferred"}, {"score": 100.0, "source": "matching"}]}, "original": {"product": "Eclipse Jetty", "source": "cna", "vendor": "Eclipse Foundation"}, "product": "jetty", "vendor": "eclipse"}], "created": "2026-07-14T11:00:09.774474+00:00", "title": "Jetty Path Normalization Bug Returning Unresolved Paths", "updated": "2026-08-01T10:15:03.452010+00:00", "vendors": ["eclipse", "eclipse$PRODUCT$jetty"]}