Directory Traversal Vulnerability in Eclipse Jetty HttpClient

CVE-2026-76184

What is CVE-2026-76184?

A directory traversal vulnerability exists within the Jetty HttpClient where improper handling of redirects may permit an attacker to manipulate path normalization. If an attacker is able to control the redirect, they can redirect the HttpClient to a malicious endpoint while improperly using valid authentication credentials. This flaw permits exploitation that may allow exposure of sensitive information associated with the compromised service when the client's credentials are sent to the attacker-controlled application.

References