Improper Request Handling in Eclipse Jetty Affecting Path Forwarding
CVE-2026-76182

6.9MEDIUM

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Jetty
Vendor
CVE Published:
15 October 2026

What is CVE-2026-76182?

The Eclipse Jetty web server has a vulnerability in the 'TryPathsHandler' and 'TryFilesFilter' components, which allows improperly validated URI query parameters. When forwarding requests to template URIs like 'index?p=$path', if the path includes reserved characters (e.g., '/s&a=1'), Jetty misinterprets the intended query. This results in the path being split into two separate query parameters, compromising the integrity of request handling. This can lead to unexpected behaviors and potential exposure of sensitive data.

Affected Version(s)

Eclipse Jetty 12.1.0 <= 12.1.12

Eclipse Jetty 12.0.0 <= 12.0.38

Eclipse Jetty 12.1.0 <= 12.1.12

References

https://github.com/jetty/jetty.project/security/advisorie...
https://gitlab.eclipse.org/security/cve-assignment/-/work...

CVSS V4

Score:
6.9
Severity:
MEDIUM
Confidentiality:
None
Integrity:
Low
Availability:
None
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

https://github.com/4ra1n
https://github.com/pyn3rd
https://github.com/unam4
.