What is the CVSS score of CVE-2026-8384?

CVE-2026-8384 has a CVSS 3.1 base score of 5.3 (Medium). CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N. EPSS exploitation probability: 0.2%.

Is there a patch available for CVE-2026-8384?

Yes, a patch is available for CVE-2026-8384. Update the affected software to the latest version immediately.

Eclipse Jetty CVE-2026-8384

EUVD-2026-43647 MEDIUM

Use of Non-Canonical URL Paths for Authorization Decisions (CWE-647)

2026-07-14 eclipse

GHSA-w7x5-g22v-xqhr

Information Disclosure Red Hat Eclipse Jetty Eclipse Foundation

5.3

CVSS 3.1 · Vendor: eclipse

Severity by source

Vendor (eclipse) PRIMARY

5.3 MEDIUM

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

vuln.today AI

5.3 MEDIUM

Network-reachable with no authentication; integrity impact limited to application path confusion, no confidentiality or availability impact since Jetty's alias checker blocks direct file serving.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N

Red Hat

5.3 MEDIUM

qualitative

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector

Network

Attack Complexity

Low

Privileges Required

None

User Interaction

None

Scope

Unchanged

Confidentiality

None

Integrity

Low

Availability

None

Lifecycle Timeline

Analysis Generated

Jul 14, 2026 - 09:34 vuln.today

Blast Radius

ecosystem impact

† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth

175 maven packages depend on org.eclipse.jetty:jetty-util (33 direct, 142 indirect)

Ecosystem-wide dependent count for version 12.0.0.

DescriptionCVE.org

In Eclipse Jetty, an HTTP URI of this form:

/public;/../admin/secret.txt

results in an unresolved path of:

/public/../admin/secret.txt

instead of the expected:

/admin/secret.txt

Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).

However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

AnalysisAI

Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an unresolved path (e.g., /public/../admin/secret.txt) to downstream web applications instead of the canonicalized form (e.g., /admin/secret.txt). Web applications that delegate path-based authorization decisions to Jetty-provided paths are susceptible to confusion attacks where an attacker crafts a URI like /public;/../admin/secret.txt to receive a path that bypasses application-layer access controls. Jetty itself is shielded by its alias checker and will not serve restricted files directly; the integrity risk materializes only in applications that consume the unresolved path for routing or authorization logic. No public exploit code or CISA KEV listing is present at time of analysis.

Technical ContextAI

Eclipse Jetty (CPE: cpe:2.3:a:eclipse_foundation:eclipse_jetty:*:*:*:*:*:*:*:*) implements the Servlet specification and handles URI path parameters - segments appearing after a semicolon (;) within a path component. When a URI such as /public;/../admin/secret.txt is parsed, the segment public;/.. is treated as a path component with an attached parameter, causing the traversal resolution to yield an unresolved intermediate path before Jetty's alias checker can normalize it. The alias checker correctly blocks serving the traversed resource, but Jetty still exposes the unresolved string to the hosted web application via request path APIs. CWE-647 (Use of Non-Canonical URL Paths for Authorization Decisions) precisely describes the root cause: authorization or routing logic operating on a non-canonical path form is vulnerable to bypass when the canonical form differs. The vulnerability is architectural - it arises when application code trusts HttpServletRequest.getPathInfo() or equivalent APIs without independently normalizing the path.

RemediationAI

No vendor-released patch version is independently confirmed from the available data; the only reference is the Eclipse GitLab work item at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108, which should be monitored for patch release. As a primary compensating control, web applications hosted on Jetty must independently normalize and canonicalize all incoming request paths before performing authorization or routing decisions - do not rely solely on the path string provided by Jetty APIs. Specifically, apply java.nio.file.Path.normalize() or equivalent URI normalization to the raw request URI before evaluating access rules; this eliminates traversal sequences regardless of how Jetty parsed them. A secondary control is to deploy a reverse proxy (e.g., nginx or Apache httpd) upstream of Jetty that performs URI normalization and rejects requests containing semicolons in path components or multiple consecutive traversal sequences before they reach Jetty. Note: blocking semicolons globally may break applications that intentionally use matrix parameters and requires application-specific testing. Access to administrative endpoints should also be restricted at the network layer to reduce exposure until a patch is available.