CVE-2026-8384: Eclipse Jetty path normalization bypass via URI path parameters

Executive brief

Eclipse Jetty is a widely used web server and servlet container. A vulnerability in how it processes web addresses (URLs) could allow an attacker to bypass security rules intended to protect sensitive areas of a website. By using specifically crafted characters in a URL, an unauthorized user might gain access to restricted pages or administrative functions.

Technical details

A path traversal vulnerability exists in Jetty's URIUtil.canonicalPath() due to improper handling of semicolon path parameters. When a semicolon is followed by a slash and a dot segment (e.g., ';/../'), the internal state tracking for slashes becomes stale, causing the normalization logic to skip the dot-dot segment. This results in a non-canonical path being returned. If an application uses PathMapped security constraints, an attacker can craft a URL that bypasses these constraints by appearing as an allowed path while resolving to a protected one. The issue is fixed in versions 12.0.35 and 12.1.9.

Affected products

• Eclipse jetty-util >= 12.0.0, <= 12.0.34
• Eclipse jetty-util >= 12.1.0, <= 12.1.8

Timeline

• 2026-07-13: disclosed
• 2026-07-14: advisory: NVD published
• 2026-07-22: patched: GitHub Advisory published/updated

References

• https://api.github.com/users/jweny
• https://github.com/jweny
• https://api.github.com/users/jweny/gists%7B/gist_id%7D
• https://api.github.com/users/jweny/repos
• https://avatars.githubusercontent.com/u/26767398?v=4
• https://api.github.com/users/jweny/events%7B/privacy%7D