CVE-2026-8384: Eclipse Jetty: Path parameter traversal
In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath() may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot segment.
A minimal example is:
/public;/../admin/secret
In my local reproduction, URIUtil.canonicalPath() returns:
/public/../admin/secret
instead of the expected normalized path:
/admin/secret
When Jetty’s SecurityHandler.PathMapped is used to protect a path prefix such as /admin/*, the non-normalized canonical path may not match the protected prefix. As a result, an unauthenticated request may bypass the configured path-based security constraint.
References
- github.com/advisories/GHSA-w7x5-g22v-xqhr
- github.com/jetty/jetty.project/commit/82969c77f6da46e27008b10b3c14840cd31db084
- github.com/jetty/jetty.project/commit/ade27ce93a37c33278720250d85c48601230ae3f
- github.com/jetty/jetty.project/pull/14969
- github.com/jetty/jetty.project/pull/14973
- github.com/jetty/jetty.project/releases/tag/jetty-12.0.35
- github.com/jetty/jetty.project/releases/tag/jetty-12.1.9
- github.com/jetty/jetty.project/security/advisories/GHSA-w7x5-g22v-xqhr
- gitlab.eclipse.org/security/cve-assignment/-/work_items/108
- nvd.nist.gov/vuln/detail/CVE-2026-8384
Code Behaviors & Features
Detect and mitigate CVE-2026-8384 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →