CVE-2018-12536: org.eclipse.jetty:jetty-server - Path Disclosure Vulnerability
Summary
CVE-2018-12536: Eclipse Jetty Server generates error message containing sensitive information. Affects org.eclipse.jetty:jetty-server across 2 version ranges.
>= 9.0.0, < 9.3.24.v20180605
>= 9.4.0, < 9.4.11.v20180605
Fixed in 9.3.24.v20180605 or 9.4.11.v20180605, depending on the release line you run. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2018-12536 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
org.eclipse.jetty:jetty-server is a Maven package that provides a Java HTTP server and servlet container. It is widely used for developing and deploying web applications. The package allows developers to create and manage web servers, handle HTTP requests, and serve static files. However, versions 9.x of the package are vulnerable to a path disclosure vulnerability.
Vulnerability Detail
The vulnerability in org.eclipse.jetty:jetty-server arises when a web application using the default error handling receives a malicious query that does not match a dynamic URL pattern. In such cases, the request is eventually handled by the DefaultServlet's static file serving. However, the presence of certain bad characters in the query can trigger a java.nio.file.InvalidPathException. This exception includes the full path to the base resource directory that the DefaultServlet and/or web application is using. If the default error handler is configured to handle this exception, the error response will reveal the full server path to the requesting system. This path disclosure can potentially aid attackers in further exploiting the server.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 9.0.0, < 9.3.24.v201806059.3.24.v20180605 -
>= 9.4.0, < 9.4.11.v201806059.4.11.v20180605
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
If upgrading to the latest version is not immediately feasible, a workaround can be implemented by customizing the error handling mechanism. By providing a custom error handler, the InvalidPathException can be caught and handled without revealing the full server path in the error response. Developers can refer to the Jetty documentation for guidance on implementing a custom error handler.
Conclusion
The path disclosure vulnerability in org.eclipse.jetty:jetty-server can expose sensitive server information to attackers. It is crucial to upgrade to the latest version or implement a custom error handler to mitigate this vulnerability. For further assistance and support in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The vulnerability allows an attacker to obtain the full server path, which can aid in further attacks and potentially expose sensitive information.
Versions 9.3.0 to 9.3.23.v20180228 and versions 9.4.0 to 9.4.10.v20180503 are affected by this vulnerability.
There is no known public exploit for this vulnerability at the time of this report.
Yes, this vulnerability can be exploited remotely by sending a malicious query to the affected server.
The recommended mitigation is to upgrade org.eclipse.jetty:jetty-server to the latest version or implement a custom error handler to prevent path disclosure in error responses.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
