Skip to content
OpenAdvisories
High ALAS2-2026-3277 1 CVE

Important: jetty security update (Amazon Linux 2)

Published Apr 27, 2026 · Updated Apr 29, 2026

Ecosystem: Amazon Linux

Summary

Package updates are available for Amazon Linux 2 that fix the following vulnerabilities: CVE-2026-5795: In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Fixed packages 36

ReleasePackageFixed in
Amazon Linux · 2 jetty-annotations 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-ant 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-client 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-continuation 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-deploy 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-http 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-io 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-jaas 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-jaspi 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-javadoc 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-jmx 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-jndi 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-jsp 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-jspc-maven-plugin 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-maven-plugin 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-monitor 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-plus 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-project 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-proxy 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-rewrite 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-runner 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-security 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-server 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-servlet 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-servlets 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-start 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-util 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-util-ajax 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-webapp 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-websocket-api 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-websocket-client 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-websocket-common 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-websocket-parent 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-websocket-server 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-websocket-servlet 0:9.0.3-8.amzn2.0.7
Amazon Linux · 2 jetty-xml 0:9.0.3-8.amzn2.0.7

Vulnerabilities 1

  • High 7.4
    CVE-2026-5795

    Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables

    In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing t…

    Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven

References

  • web
    https://alas.aws.amazon.com/cve/html/CVE-2026-5795.html