VYPR
← All advisories
Medium severity5.3NVD Advisory· Published Jul 14, 2026· Updated Jul 14, 2026

CVE-2026-8384

CVE-2026-8384

Description

In Eclipse Jetty, an HTTP URI of this form:

/public;/../admin/secret.txt

results in an unresolved path of:

/public/../admin/secret.txt

instead of the expected:

/admin/secret.txt

Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).

However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.eclipse.jetty:jetty-utilMaven
>= 12.0.0, < 12.0.3512.0.35
org.eclipse.jetty:jetty-utilMaven
>= 12.1.0, < 12.1.912.1.9

Affected products

58

Patches

Vulnerability mechanics

References

10

News mentions

0

No linked articles in our index yet.