Description
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | 12.1.0 – ≤ 12.1.7, 12.0.0 – ≤ 12.0.33, 11.0.0 – ≤ 11.0.28, 10.0.0 – ≤ 10.0.28, 9.4.0 – ≤ 9.4.60 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jetty12 | 12.0.39-1 | — |
| Debian 14 | jetty9 | No fix yet | — |
| Debian 13 | jetty9 +1 | No fix yet | — |
| Debian 12 | jetty9 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jetty9 | No fix yet | — |
| Ubuntu 26.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 25.10 | jetty9 | No fix yet | — |
| Ubuntu 24.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 22.04 LTS | jetty9 | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 18.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 16.04 LTS | jetty +1 | No fix yet | — |
| Ubuntu 14.04 LTS | jetty | No fix yet | — |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jetty-minimal | 9.4.58-4.1 | openSUSE-SU-2026:10574-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | jetty-io +35 | 9.0.3-8.amzn2.0.7 | ALAS2-2026-3277 |
Affected packages
Advisories 10
- WID-SEC-2026-4090 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 11, 2026
- WID-SEC-2026-2437 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2026
- WID-SEC-2026-1014 Eclipse Jetty: Schwachstelle ermöglicht Privilegieneskalation BSI CERT-Bund (WID) · Sep 16, 2026
- NCSC-2026-0309 Kwetsbaarheden verholpen in Oracle Communications NCSC-NL (Netherlands) · Aug 19, 2026
- WID-SEC-2026-2887 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 18, 2026
- NCSC-2026-0258 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jul 22, 2026
- WID-SEC-2026-2445 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 21, 2026
- WID-SEC-2026-2260 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 8, 2026
- ALAS2-2026-3277 Important: jetty security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Apr 29, 2026
- openSUSE-SU-2026:10574-1 jetty-annotations-9.4.58-4.1 on GA media SUSE / openSUSE Security Updates · Apr 19, 2026