# CVE-2026-8384: Eclipse Jetty path normalization bypass via URI path parameters

Source: https://junglewise.ai/threats/cve-2026-8384-eclipse-jetty-path-normalization-bypass-via-uri-path-parameters  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-8384 · Severity: medium · CVSS 5.3 · Published 2026-07-14

Eclipse Jetty is a widely used web server and servlet container. A vulnerability in how it processes web addresses (URLs) could allow an attacker to bypass security rules intended to protect sensitive areas of a website. By using specifically crafted characters in a URL, an unauthorized user might gain access to restricted pages or administrative functions.

Technologies: [Eclipse Foundation Jetty](https://junglewise.ai/threats/technologies/jetty). Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-8384 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-8384 being exploited in the wild.

**How severe is CVE-2026-8384?** Medium severity, with a CVSS score of 5.3, published 14 July 2026.

**Which products and versions are affected?** Eclipse Foundation Jetty 12.0.0 to 12.0.34, 12.1.0 to 12.1.8; org.eclipse.jetty:jetty-util (Maven) ECOSYSTEM:introduced=12.0.0,fixed=12.0.35.

**Is there a fix for CVE-2026-8384?** Yes. org.eclipse.jetty:jetty-util (Maven): upgrade to 12.0.35 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-8384 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-8384?** Check whether you run Eclipse Foundation Jetty, Eclipse Foundation Jetty Utility Library or org.eclipse.jetty:jetty-util (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.eclipse.jetty:jetty-util (Maven): upgrade to 12.0.35 or later

  ```sh
  # set org.eclipse.jetty:jetty-util to 12.0.35 in your pom.xml or build.gradle
  ```


## Technical details

A path traversal vulnerability exists in Jetty's URIUtil.canonicalPath() due to improper handling of semicolon path parameters. When a semicolon is followed by a slash and a dot segment (e.g., ';/../'), the internal state tracking for slashes becomes stale, causing the normalization logic to skip the dot-dot segment. This results in a non-canonical path being returned. If an application uses PathMapped security constraints, an attacker can craft a URL that bypasses these constraints by appearing as an allowed path while resolving to a protected one. The issue is fixed in versions 12.0.35 and 12.1.9.

## Affected products

- Eclipse jetty-util >= 12.0.0, <= 12.0.34
- Eclipse jetty-util >= 12.1.0, <= 12.1.8

## Identifiers

- CVE-2026-8384
- GHSA-w7x5-g22v-xqhr

## Timeline

- 2026-07-13: disclosed
- 2026-07-14: advisory: NVD published
- 2026-07-22: patched: GitHub Advisory published/updated

## References

- [https://api.github.com/users/jweny](https://api.github.com/users/jweny)
- [https://github.com/jweny](https://github.com/jweny)
- [https://api.github.com/users/jweny/gists%7B/gist_id%7D](https://api.github.com/users/jweny/gists%7B/gist_id%7D)
- [https://api.github.com/users/jweny/repos](https://api.github.com/users/jweny/repos)
- [https://avatars.githubusercontent.com/u/26767398?v=4](https://avatars.githubusercontent.com/u/26767398?v=4)
- [https://api.github.com/users/jweny/events%7B/privacy%7D](https://api.github.com/users/jweny/events%7B/privacy%7D)

## Related threats

- [Eclipse Jetty host authority and Host header mismatch](https://junglewise.ai/threats/cve-2026-6790-eclipse-jetty-host-authority-and-host-header-mismatch)
- [Eclipse Jetty information leakage via retained HTTP/1.1 trailers](https://junglewise.ai/threats/cve-2026-10051-eclipse-jetty-information-leakage-via-retained-http-1-1-trailers)
- [Eclipse Jetty buffer leak in HttpConnection](https://junglewise.ai/threats/cve-2024-7708-eclipse-jetty-buffer-leak-in-httpconnection)
- [Eclipse Jetty HTTP request smuggling in chunk extension parsing](https://junglewise.ai/threats/cve-2026-2332-eclipse-jetty-http-request-smuggling-in-chunk-extension-parsing)
- [Eclipse Jetty privilege escalation in JASPIAuthenticator](https://junglewise.ai/threats/eclipse-jetty-privilege-escalation-in-jaspiauthenticator-0b1324cb)