Improper Neutralization of Special Elements in Output Used by a Downstream Component in Jetty - CVE-2026-76182
Published: October 15, 2026
Vulnerability identifier: #VU155894
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2026-76182
CWE-ID: CWE-74
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to inject query parameters into rewritten requests received by a downstream application.
The vulnerability exists due to improper neutralization of query delimiters in TryPathsHandler when interpolating decoded request paths into fallback URI query values. A remote attacker can send a request containing an encoded ampersand in its path to inject query parameters into rewritten requests received by a downstream application.
Further security consequences depend on the downstream application trusting the injected parameters for sensitive decisions, such as routing, object selection, tenant selection, or authorization.
Affected software
Jetty
How to mitigate CVE-2026-76182
Install security update from vendor's website.
Jetty - addressed in versions 9.4.65, 10.0.33, 12.0.39, 12.1.13