Description
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Eclipse Foundation | Eclipse Jetty | 9.4.37.v20210219 – < unspecified, unspecified – ≤ 9.4.38.v20210224 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jetty9 | 9.4.39-1 | — |
| Debian 13 | jetty9 | 9.4.39-1 | — |
| Debian 12 | jetty9 | 9.4.39-1 | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | equinox-bundles | No fix yet | — |
| Ubuntu 20.04 LTS | equinox-bundles | No fix yet | — |
| Ubuntu 18.04 LTS | equinox-bundles | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Devtools 2021 | rh-eclipse-jetty +14 | 9.4.40-1.1.el7_9 | RHSA-2021:1509 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP3 | jetty-minimal | 9.4.42-3.9.1 | SUSE-SU-2021:2005-1 |
| SLES 15 SP2 | jetty-minimal | 9.4.42-3.9.1 | SUSE-SU-2021:2005-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.3 | jetty-minimal +1 | 9.4.42-3.9.1 | openSUSE-SU-2021:2005-1 |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Metasploit 1 module
-
Jetty WEB-INF File Disclosure
auxiliary/gather/jetty_web_inf_disclosure
Exploit-DB 1
- Jetty 9.4.37.v20210219 - Information Disclosure EDB-50438 · webapps · Oct 22, 2021
GitHub 2 repositories
-
CyberCTF/vulhub-jetty-cve-2021-28164 ★ 0 · Oct 8, 2026
Vulhub jetty/CVE-2021-28164: Jetty Ambiguous Path Information Disclosure (CVE-2021-28164), run with Isoloom
-
jammy0903/-jettyCVE-2021-28164- ★ 0 · Oct 31, 2023
jetty /CVE-2021-28164/분석 및 결과
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Automated scanner template
A ready-made Nuclei template detects this vulnerability automatically. Vulnerabilities with public scanner templates are typically probed across the internet soon after the template appears — exposed systems should be patched first.
- Eclipse Jetty - Information Disclosure http/cves/2021/CVE-2021-28164.yaml
Source: projectdiscovery/nuclei-templates (MIT) — updated daily. Only links are listed.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-webapp | >= 9.4.37, < 9.4.39 | 9.4.39 | GHSA-v7ff-8wcx-gmc5 |
Advisories 4
- RHSA-2021:1509 Red Hat Security Advisory: rh-eclipse-jetty security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- openSUSE-SU-2021:2005-1 Security update for jetty-minimal SUSE / openSUSE Security Updates · Feb 4, 2026
- SUSE-SU-2021:2005-1 Security update for jetty-minimal SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2022-1365 Eclipse Jetty: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 29, 2025
References
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5
- [kafka-jira] 20210412 [GitHub] [kafka] dongjinleekr opened a new pull request #10526: KAFKA-12655: CVE-2021-28165 - Upgrade jetty to 9.4.39 mailing-list
- [ignite-issues] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty mailing-list
- [ignite-dev] 20210413 [jira] [Created] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty mailing-list
- [solr-issues] 20210414 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr mailing-list
- [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty mailing-list
- [ignite-issues] 20210426 [jira] [Commented] (IGNITE-14527) CVE-2021-2816[3,4,5] in Jetty mailing-list
- [ignite-issues] 20210426 [jira] [Updated] (IGNITE-14527) Upgrade Jetty version to fix CVE-2021-2816[3,4,5] in Jetty mailing-list
- [solr-issues] 20210507 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr mailing-list
- [solr-issues] 20210623 [jira] [Updated] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr mailing-list
- [solr-issues] 20210711 [jira] [Created] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 mailing-list
- [solr-issues] 20210711 [jira] [Updated] (SOLR-15529) High security vulnerability in JDOM library bundled within Solr 8.9 CVE-2021-33813 mailing-list
- https://security.netapp.com/advisory/ntap-20210611-0006/
- [zookeeper-issues] 20210728 [jira] [Updated] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 mailing-list
- [zookeeper-issues] 20210728 [jira] [Created] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 mailing-list
- [zookeeper-dev] 20210728 [jira] [Created] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 mailing-list
- [zookeeper-issues] 20210805 [jira] [Assigned] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 mailing-list
- [zookeeper-issues] 20210805 [jira] [Updated] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 mailing-list
- [solr-issues] 20210813 [jira] [Resolved] (SOLR-15338) High security vulnerability in Jetty library CVE-2021-28163 (+5) bundled within Solr mailing-list
- [zookeeper-issues] 20210901 [jira] [Resolved] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 mailing-list
- https://www.oracle.com/security-alerts/cpuoct2021.html
- [zookeeper-issues] 20211028 [jira] [Updated] (ZOOKEEPER-4337) CVE-2021-34429 in jetty 9.4.38.v20210224 in zookeeper 3.7.0 mailing-list
- https://www.oracle.com/security-alerts/cpujan2022.html
- http://packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.html
- https://www.oracle.com/security-alerts/cpuapr2022.html