CVE-2026-8384: Eclipse Jetty Path Parameter Traversal Vulnerability
Summary
CVE-2026-8384: Eclipse Jetty: Path parameter traversal. Affects org.eclipse.jetty:jetty-util across 2 version ranges.
>= 12.0.0, < 12.0.35
>= 12.1.0, < 12.1.9
Fixed in 12.0.35 or 12.1.9, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a widely used open-source Java-based web server and servlet container that provides a robust environment for running web applications. It is known for its scalability, performance, and support for modern web standards. However, Jetty has a vulnerability that affects its URI handling, specifically in the version 12.1.8, which can lead to security issues if not addressed.
Vulnerability Detail
In Jetty version 12.1.8, the method org.eclipse.jetty.util.URIUtil.canonicalPath() fails to normalize dot-dot path segments when a semicolon path parameter is followed by a slash and a dot segment. This flaw allows an attacker to bypass security constraints by crafting a URL that appears to be outside of the protected path. For example, a request to '/public;/.admin/secret' would be incorrectly processed, potentially allowing unauthorized access to sensitive resources.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.0.3512.0.35 -
>= 12.1.0, < 12.1.912.1.9
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can implement additional security checks in your application to validate and sanitize incoming URLs, ensuring that they do not contain unexpected path segments. This can help mitigate the risk of unauthorized access until the package is updated.
Conclusion
The CVE-2026-8384 vulnerability in Eclipse Jetty poses a significant risk by allowing path parameter traversal, which can lead to unauthorized access. It is crucial for users of affected versions to update to the patched version 12.1.9 or later to mitigate this risk. Implementing additional security measures can also help protect against potential exploitation.
See every vulnerability recorded for org.eclipse.jetty:jetty-util →
FAQ
CVE-2026-8384 is a vulnerability in Eclipse Jetty that allows for path parameter traversal, potentially enabling unauthorized access to protected resources.
The vulnerability affects Jetty versions 12.1.8 and earlier. It is fixed in version 12.1.9 and later.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Visit Vulert Scanner to check if your application is affected by this vulnerability.
If exploited, this vulnerability can allow attackers to bypass security constraints, leading to unauthorized access to sensitive resources within your application.
The CVSS score for this vulnerability is 5.3, indicating a moderate level of risk.
