Eclipse Jetty: Mehrere Schwachstellen

Summary

Product

Vulnerabilities 7

• High 8.8
  CVE-2026-18660

  Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames

  In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.

  Eclipse Foundation org.eclipse.jetty:jetty-proxy org.eclipse.jetty:jetty-server jetty9 Debian Ubuntu
  Oct 15, 2026
• High 8.8
  CVE-2026-18661

  In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authori…

  Eclipse Foundation org.eclipse.jetty.ee11:jetty-ee11-annotations org.eclipse.jetty.ee9:jetty-ee9-annotations org.eclipse.jetty:jetty-annotations Debian Ubuntu
  Oct 15, 2026
• High 8.2
  CVE-2026-76184

  In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to cont…

  Eclipse Foundation Eclipse Jetty jetty9 jetty Debian Ubuntu
  Oct 15, 2026
• High 8.2
  CVE-2026-77711

  When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Au…

  Eclipse Foundation Eclipse Jetty jetty9 jetty Debian Ubuntu
  Oct 15, 2026
• Medium 6.9
  CVE-2026-18659

  Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring

  In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.

  Eclipse Foundation org.eclipse.jetty:jetty-security org.eclipse.jetty.ee10:jetty-ee10-servlet org.eclipse.jetty.ee8:jetty-ee8-security Debian Ubuntu
  Oct 15, 2026
• Medium 6.9
  CVE-2026-18662

  In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constrain…

  Eclipse Foundation org.eclipse.jetty:jetty-security org.eclipse.jetty.ee9:jetty-ee9-security org.eclipse.jetty.ee10:jetty-ee10-servlet Debian Ubuntu
  Oct 15, 2026
• Medium 5.6
  CVE-2026-19864

  Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentia…

  Eclipse Foundation org.eclipse.jetty:jetty-security jetty9 jetty9 Debian Ubuntu
  Oct 15, 2026

Revision history

1. 2026-11-05 #4

   Neue Updates von Red Hat aufgenommen

2. 2026-10-29 #3

   Neue Updates von Red Hat aufgenommen

3. 2026-10-21 #2

   Neue Updates von Red Hat aufgenommen

4. 2026-10-15 #1

   Initiale Fassung

References

• Jetty Security Advisory vom 2026-10-15
  https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf
• Jetty Security Advisory vom 2026-10-15
  https://github.com/jetty/jetty.project/security/advisories/GHSA-53x7-f9fc-h7qr
• Jetty Security Advisory vom 2026-10-15
  https://github.com/jetty/jetty.project/security/advisories/GHSA-PHJH-V7C6-G7MV
• Jetty Security Advisory vom 2026-10-15
  https://github.com/jetty/jetty.project/security/advisories/GHSA-Q6WX-J9WR-FJ7F
• Jetty Security Advisory vom 2026-10-15
  https://github.com/jetty/jetty.project/security/advisories/GHSA-QFR2-43G5-G768
• Jetty Security Advisory vom 2026-10-15
  https://github.com/jetty/jetty.project/security/advisories/GHSA-R2C5-3P8G-WPVW
• Jetty Security Advisory vom 2026-10-15
  https://github.com/jetty/jetty.project/security/advisories/GHSA-V6XF-996F-C35F
• Red Hat Security Advisory RHSA-2026:88150 vom 2026-10-22
  https://access.redhat.com/errata/RHSA-2026:88150
• Red Hat Security Advisory RHSA-2026:92859 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92859
• Red Hat Security Advisory RHSA-2026:92860 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92860
• Red Hat Security Advisory RHSA-2026:92858 vom 2026-10-29
  https://access.redhat.com/errata/RHSA-2026:92858
• Red Hat Security Advisory RHSA-2026:95622 vom 2026-11-05
  https://access.redhat.com/errata/RHSA-2026:95622