SB20261015130 - Multiple vulnerabilities in Jetty

CSH
CYBERSECURITY HELP
Sign In REGISTER

Main Vulnerability Database SB20261015130

SB20261015130 - Multiple vulnerabilities in Jetty

Published: October 15, 2026

Security Bulletin ID SB20261015130
CSH Severity
High
Patch available
YES
Number of vulnerabilities 8
Exploitation vector Remote access
Highest impact Data manipulation

Breakdown by Severity

High 38% Medium 63%
  • Low
  • Medium
  • High
  • Critical

Description

This security bulletin contains information about 8 vulnerabilities.


1) Improper Neutralization of Special Elements in Output Used by a Downstream Component (CVE-ID: CVE-2026-76182)

CWE-ID: CWE-74 - Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to inject query parameters into rewritten requests received by a downstream application.

The vulnerability exists due to improper neutralization of query delimiters in TryPathsHandler when interpolating decoded request paths into fallback URI query values. A remote attacker can send a request containing an encoded ampersand in its path to inject query parameters into rewritten requests received by a downstream application.

Further security consequences depend on the downstream application trusting the injected parameters for sensitive decisions, such as routing, object selection, tenant selection, or authorization.


2) Incorrect authorization (CVE-ID: CVE-2026-18662)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass servlet authorization constraints.

The vulnerability exists due to overwriting rather than combining applicable security constraints in Jetty's ConstraintSecurityHandler.processConstraintMappingWithMethodOmissions() when processing mappings with identical method-omission keys. A remote attacker can send a request using a non-omitted HTTP method to bypass servlet authorization constraints.

Exploitation requires a static application configuration in which a permissive mapping is processed after a deny or role-restricted mapping with the same omission key. The attacker does not control descriptor processing order.


3) Incorrect authorization (CVE-ID: CVE-2026-18661)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass servlet access restrictions and potentially disclose sensitive information or perform unauthorized state-changing operations.

The vulnerability exists due to incorrect authorization in Jetty's ServletSecurityAnnotationHandler when processing a multi-mapped servlet whose deployment descriptor constrains only some of its URL mappings. A remote attacker can send requests to an alternate mapping whose ServletSecurity annotation has been incorrectly suppressed to bypass servlet access restrictions and potentially disclose sensitive information or perform unauthorized state-changing operations.


4) Information disclosure (CVE-ID: CVE-2026-77711)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose proxy authentication credentials.

The vulnerability exists due to improper validation of the source of proxy authentication challenges in Jetty HttpClient's ProxyAuthenticationProtocolHandler when processing origin responses inside an established HTTPS CONNECT tunnel. A remote attacker can return a crafted 407 response with a Proxy-Authenticate: Basic header from a controlled HTTPS origin to disclose proxy authentication credentials.

Exploitation requires the client to have matching challenge-based proxy credentials configured. The proxy itself does not need to be controlled by the attacker, and disabling certificate validation is not required.


5) Information disclosure (CVE-ID: CVE-2026-76184)

CWE-ID: CWE-200 - Exposure of sensitive information to an unauthorized actor

CVSSv4: 8.2 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to disclose sensitive authentication credentials outside their configured path scope.

The vulnerability exists due to missing path normalization before credential scope validation in Jetty HttpClient's AbstractAuthentication.matchesURI() method when matching cached credentials to redirected request paths. A remote attacker can influence a same-origin redirect containing dot segments to disclose sensitive authentication credentials outside their configured path scope.

The demonstrated exposure involves Basic authentication; other authentication mechanisms have not been validated. The issue is particularly relevant when sibling paths belong to different applications or trust domains.


6) Improper Handling of Case Sensitivity (CVE-ID: CVE-2026-18660)

CWE-ID: CWE-178 - Improper Handling of Case Sensitivity

CVSSv4: 8.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass destination restrictions and access blocked internal HTTP services or TCP endpoints through the proxy.

The vulnerability exists due to improper handling of case sensitivity in Jetty's ProxyServlet and ConnectHandler when comparing requested DNS hostnames and ports against blacklist entries. A remote attacker can submit an HTTP proxy request or CONNECT request using a case variant of a blacklisted hostname to bypass destination restrictions and access blocked internal HTTP services or TCP endpoints through the proxy.

Blacklist-only configurations are directly affected. This hostname-case technique does not affect numeric IP literals or fixed-target reverse proxies. Destination access remains subject to network reachability and target-side authorization.


7) Authentication bypass using an alternate path or channel (CVE-ID: CVE-2026-19863)

CWE-ID: CWE-288 - Authentication Bypass Using an Alternate Path or Channel

CVSSv4: 9.3 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authentication and role constraints to access protected data or perform unauthorized actions.

The vulnerability exists due to unanchored login-path substring matching in Jetty's EthereumAuthenticator when identifying the public login page from canonical context-relative request paths. A remote attacker can send a request to a protected route containing the configured login path at a later path segment to bypass authentication and role constraints to access protected data or perform unauthorized actions.

Routes explicitly marked FORBIDDEN remain blocked.


8) Incorrect authorization (CVE-ID: CVE-2026-18659)

CWE-ID: CWE-863 - Incorrect Authorization

CVSSv4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]


The vulnerability allows a remote attacker to bypass authorization constraints and access protected functionality.

The vulnerability exists due to incorrect authorization caused by substring matching instead of exact method matching in ConstraintSecurityHandler.getConstraint() when evaluating HTTP method omission constraints. A remote attacker can send a request using an HTTP method whose name is a substring of an omitted method name to bypass authorization constraints and access protected functionality.

Exploitation requires the endpoint to serve the colliding request method. For example, omitting PROPPATCH can leave PATCH requests unprotected, and omitting UNLOCK can leave LOCK requests unprotected. Blanket constraints without HTTP method restrictions are not affected.


Remediation

Install update from vendor's website.

References