CVE-2026-76182 PUBLISHED

Assigner: eclipse
Reserved: 19.08.2026 Published: 15.10.2026 Updated: 15.10.2026

In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context.

However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the template becomes index?p=/s&a=1, which is interpreted as 2 query parameters: p=/s and a=1, rather than just one query parameter p whose value is /s&a=1.

Metrics

CVSS Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
CVSS Score: 6.9

Product Status

Vendor Eclipse Foundation
Product Eclipse Jetty
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.12 (incl.)
  • affected from 12.0.0 to 12.0.38 (incl.)
Vendor Eclipse Foundation
Product Eclipse Jetty
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.12 (incl.)
Vendor Eclipse Foundation
Product Eclipse Jetty
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.12 (incl.)
  • affected from 12.0.0 to 12.0.38 (incl.)
Vendor Eclipse Foundation
Product Eclipse Jetty
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.12 (incl.)
  • affected from 12.0.0 to 12.0.38 (incl.)
Vendor Eclipse Foundation
Product Eclipse Jetty
Versions Default: unaffected
  • affected from 11.0.0 to 11.0.32 (incl.)
  • affected from 10.0.0 to 10.0.32 (incl.)
  • affected from 9.4.0 to 9.4.64 (incl.)
Vendor Eclipse Foundation
Product Eclipse Jetty
Versions Default: unaffected
  • affected from 12.1.0 to 12.1.12 (incl.)
  • affected from 12.0.0 to 12.0.38 (incl.)

Credits

  • https://github.com/4ra1n finder
  • https://github.com/pyn3rd finder
  • https://github.com/unam4 finder

References

Problem Types

  • CWE-74 CWE