UpHeron
All vulnerabilities

Servers and applications

CVE-2026-76184

In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`. This also mean that the attacker must have an…

Severity
High 8.2
Published
15 Oct 2026
Last changed
15 Oct 2026
Added to UpHeron
3 Nov 2026
Sources
CVE Program

Affected software

SoftwareAffected versions
Eclipse JettyServers and applications · cna:eclipse foundation|eclipse jetty
  • From 9.4.0 up to 9.4.64
  • From 10.0.0 up to 10.0.32
  • From 11.0.0 up to 11.0.32
  • From 12.0.0 up to 12.0.38
  • From 12.1.0 up to 12.1.12

References

  • CVE.org https://www.cve.org/CVERecord?id=CVE-2026-76184