CVE-2026-8384: Eclipse Jetty path normalization bypass via URI path parameters

CVE-2026-8384 · Severity: medium · CVSS 5.3 · Published 2026-07-14

Eclipse Jetty is a widely used web server and servlet container. A vulnerability in how it processes web addresses (URLs) could allow an attacker to bypass security rules intended to protect sensitive areas of a website. By using specifically crafted characters in a URL, an unauthorized user might gain access to restricted pages or administrative functions.

Technologies: Eclipse Foundation Jetty. Vendors: Eclipse Foundation, Maven.

Quick answers

Is CVE-2026-8384 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-8384 being exploited in the wild.
How severe is CVE-2026-8384?
Medium severity, with a CVSS score of 5.3, published 14 July 2026.
Which products and versions are affected?
Eclipse Foundation Jetty 12.0.0 to 12.0.34, 12.1.0 to 12.1.8; org.eclipse.jetty:jetty-util (Maven) ECOSYSTEM:introduced=12.0.0,fixed=12.0.35.
Is there a fix for CVE-2026-8384?
Yes. org.eclipse.jetty:jetty-util (Maven): upgrade to 12.0.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-8384 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-8384?
Check whether you run Eclipse Foundation Jetty, Eclipse Foundation Jetty Utility Library or org.eclipse.jetty:jetty-util (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.eclipse.jetty:jetty-util (Maven): upgrade to 12.0.35 or later
    # set org.eclipse.jetty:jetty-util to 12.0.35 in your pom.xml or build.gradle

Technical details

A path traversal vulnerability exists in Jetty's URIUtil.canonicalPath() due to improper handling of semicolon path parameters. When a semicolon is followed by a slash and a dot segment (e.g., ';/../'), the internal state tracking for slashes becomes stale, causing the normalization logic to skip the dot-dot segment. This results in a non-canonical path being returned. If an application uses PathMapped security constraints, an attacker can craft a URL that bypasses these constraints by appearing as an allowed path while resolving to a protected one. The issue is fixed in versions 12.0.35 and 12.1.9.

Affected products

  • Eclipse jetty-util >= 12.0.0, <= 12.0.34
  • Eclipse jetty-util >= 12.1.0, <= 12.1.8

Identifiers

  • CVE-2026-8384
  • GHSA-w7x5-g22v-xqhr

Timeline

  • 2026-07-13: disclosed
  • 2026-07-14: advisory: NVD published
  • 2026-07-22: patched: GitHub Advisory published/updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.