Eclipse Foundation Eclipse Jetty
15 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2026-77711 | 12.1.0 – 12.1.12 ; 12.0.0 – 12.0.38 ; 11.0.0 – 11.0.32 ; … | When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required | HIGH 8.2 | 0.4 % | ||
| CVE-2026-76184 | 12.1.0 – 12.1.12 ; 12.0.0 – 12.0.38 ; 11.0.0 – 11.0.32 ; … | In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the r | HIGH 8.2 | 0.4 % | ||
| CVE-2026-76182 | 12.1.0 – 12.1.12 ; 12.0.0 – 12.0.38 | In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, whe | MEDIUM 6.9 | 0.3 % | ||
| CVE-2026-12611 | 12.1.0 – 12.1.10 ; 12.0.0 – 12.0.37 ; 11.00 – 11.0.31 ; … | A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads | HIGH 8.7 | 0.4 % | ||
| CVE-2026-19203 | 12.1.0 – 12.1.11 ; 12.0.0 – 12.0.37 ; 11.0.0 – 11.0.31 ; … | A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret dif | HIGH 8.3 | 0.5 % | ||
| CVE-2026-19204 | 12.1.0 – 12.1.11 ; 12.0.0 – 12.0.37 ; 11.0.0 – 11.0.31 ; … | A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory | HIGH 8.7 | 0.5 % | ||
| CVE-2026-10050 | 9.4.0 – 9.4.62 ; 10.0.0 – 10.0.30 ; 11.0.0 – 11.0.30 ; … | Digest authentication lossy encoding | HIGH 8.7 | 0.6 % | ||
| CVE-2024-7708 | 10.0.7 – < 10.0.23 ; 11.0.7 – < 11.0.23 | For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for | HIGH 7.5 | 0.4 % | ||
| CVE-2026-8384 | 12.0.0 – 12.0.34 ; 12.1.0 – 12.1.8 | In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admi | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-6790 | 9.4.0 – 9.4.60 ; 10.0.0 – 10.0.28 ; 11.0.0 – 11.0.28 ; … | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what p | MEDIUM 5.3 | 0.3 % | ||
| CVE-2026-10051 | 12.0.0 – 12.0.35 ; 12.1.0 – 12.1.9 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the | MEDIUM 6.9 | 0.4 % | ||
| CVE-2026-2332 | 12.1.0 – 12.1.6 ; 12.0.0 – 12.0.32 ; 11.0.0 – 11.0.28 ; … | HTTP Request Smuggling via Chunked Extension Quoted-String Parsing | CRITICAL 9.1 | 1.3 % | ||
| CVE-2026-5795 | 12.1.0 – 12.1.7 ; 12.0.0 – 12.0.33 ; 11.0.0 – 11.0.28 ; … | In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning fro | HIGH 7.4 | 0.5 % | ||
| CVE-2026-1605 | 12.0.0 – 12.0.31 ; 12.1.0. – 12.1.5 | In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with | HIGH 7.5 | 0.7 % | ||
| CVE-2025-11143 | 9.4.0 – 9.4.58 ; 10.0.0 – 10.0.26 ; 11.0.0 – 11.0.26 ; … | The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs | MEDIUM 6.5 | 0.2 % |