All vulnerabilities

Servers and applications

CVE-2026-76182

In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and…

Severity
Medium 6.9
Published
15 Oct 2026
Last changed
15 Oct 2026
Added to UpHeron
3 Nov 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
Eclipse JettyServers and applications · cna:eclipse foundation|eclipse jetty
  • From 9.4.0 up to 9.4.64
  • From 10.0.0 up to 10.0.32
  • From 11.0.0 up to 11.0.32
  • From 12.0.0 up to 12.0.38
  • From 12.1.0 up to 12.1.12

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-76182