Skip to main content

Eclipse Jetty EUVDEUVD-2026-20473

| CVE-2026-5795 HIGH
Sensitive Information in Resource Not Removed Before Reuse (CWE-226)
2026-04-08 eclipse GHSA-gc59-r5jq-98qw GHSA-r7p8-xq5m-436c
Privilege Escalation Eclipse Jetty
7.4
CVSS 3.1 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE
HIGH
qualitative
Red Hat
7.4 HIGH
qualitative

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Re-analysis Queued
Apr 23, 2026 - 12:07 vuln.today
cvss_changed
Patch released
Apr 09, 2026 - 02:30 nvd
Patch available
EUVD ID Assigned
Apr 08, 2026 - 14:16 euvd
EUVD-2026-20473
Analysis Generated
Apr 08, 2026 - 14:16 vuln.today
CVE Published
Apr 08, 2026 - 13:32 nvd
HIGH 7.4

DescriptionCVE.org

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.

Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.

A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

AnalysisAI

Privilege escalation in Eclipse Jetty 9.4.0-12.1.7 allows unauthenticated remote attackers to bypass authentication via ThreadLocal variable pollution in JASPIAuthenticator. Early returns from authentication checks fail to clear ThreadLocal values, causing subsequent requests on the same thread to inherit elevated privileges. CVSS 7.4 with high complexity but no authentication required. EPSS and KEV status not provided; no public exploit identified at time of analysis. Affects all major Jetty versions from 9.x through 12.x.

Technical ContextAI

Eclipse Jetty's JASPIAuthenticator class implements Java Authentication Service Provider Interface for Containers (JASPIC) authentication flows. During authentication checks, the authenticator sets ThreadLocal variables to maintain request-scoped authentication state. CWE-226 (Sensitive Information in Resource Not Removed Before Reuse) describes the root cause: certain code paths trigger early returns without properly clearing these ThreadLocals. In servlet containers like Jetty that use thread pooling for request handling, threads are reused across multiple HTTP requests. When ThreadLocal cleanup fails, the next request handled by that thread inherits the previous request's authentication context, including potentially elevated privileges. This represents a classic thread reuse vulnerability where security-critical state bleeds between requests due to improper resource cleanup in authentication middleware.

RemediationAI

Upgrade to patched Eclipse Jetty versions that properly clear ThreadLocal variables in all JASPIAuthenticator code paths. Consult the official vendor security advisory at github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c for exact fixed versions corresponding to each affected major release branch (specific patch versions not provided in available intelligence data). As an interim mitigation if immediate patching is not feasible, consider disabling JASPIC authentication and switching to alternative authentication mechanisms, though this may require application refactoring. Review access logs for anomalous privilege escalation patterns, particularly authenticated actions immediately following failed authentication attempts on the same connection. Implement additional authorization checks at the application layer as defense-in-depth. Refer to Eclipse GitLab issue gitlab.eclipse.org/security/cve-assignment/-/issues/92 for upstream technical details and patch commit references.

More in Eclipse Jetty

View all
CVE-2026-2332 CRITICAL
9.1 Apr 14

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote unauthenticated attackers desynchronize front-end/
CVE-2026-10051 MEDIUM
6.9 Jul 14

HTTP/1.1 trailer leakage in Eclipse Jetty allows a remote unauthenticated attacker to read trailer headers from a previo
CVE-2026-6790 MEDIUM
5.3 Jul 14

Eclipse Jetty fails to enforce RFC 9110/9112's requirement that the HTTP request authority (host and port) match the val
CVE-2026-8384 MEDIUM
5.3 Jul 14

Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an

Same weakness CWE-226 – Sensitive Information in Resource Not Removed Before Reuse

View all
CVE-2019-25560 HIGH POC
8.7
CVE-2019-25617 MEDIUM POC
6.9
CVE-2019-25553 MEDIUM POC
6.9
CVE-2019-25657 MEDIUM POC
6.8
CVE-2019-25645 MEDIUM POC
6.2
CVE-2019-25571 MEDIUM POC
6.2
CVE-2019-25563 MEDIUM POC
6.2
CVE-2026-74791 CRITICAL
9.2

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

EUVD-2026-20473 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy