Description
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Eclipse Foundation | Eclipse Jetty | unspecified – ≤ 9.2.0, 9.3.0 – < unspecified, unspecified – < 9.3.24, 9.4.0 – < unspecified, unspecified – < 9.4.11 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jetty9 | 9.2.25-1 | — |
| Debian 13 | jetty9 | 9.2.25-1 | — |
| Debian 12 | jetty9 | 9.2.25-1 | — |
| Debian 9 | jetty9 | 9.2.30-0+deb9u1 | DLA-2661-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | jetty9 | No fix yet | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | >= 9.4.0, < 9.4.11.v20180605 | 9.4.11.v20180605 | GHSA-9rgv-h7x4-qw8g |
| Maven | org.eclipse.jetty:jetty-server | >= 9.0.0, < 9.3.24.v20180605 | 9.3.24.v20180605 | GHSA-9rgv-h7x4-qw8g |
Advisories 1
- DLA-2661-1 jetty9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 1041194 vdb-entry
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806 mailing-list
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535670
- [debian-lts-announce] 20210514 [SECURITY] [DLA 2661-1] jetty9 security update mailing-list