Skip to main content

Eclipse Jetty EUVDEUVD-2026-20473

| CVE-2026-5795 HIGH
Sensitive Information in Resource Not Removed Before Reuse (CWE-226)
2026-04-08 eclipse GHSA-gc59-r5jq-98qw GHSA-r7p8-xq5m-436c
Privilege Escalation Eclipse Jetty Eclipse Foundation
7.4
CVSS 3.1 · Vendor: eclipse
View

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata – not a confirmed exploit chain

  1. Access
    Send initial request triggering early return
  2. Delivery
    ThreadLocal variables remain uncleared
  3. Exploit
    Reuse same thread for subsequent request
  4. Execution
    Inherit privileged ThreadLocal context
  5. Impact
    Bypass access controls and escalate privileges

Vulnerability Assessment

Weakness
CWE
CWE-226
ASVS 5.0
V14 - Data Protection Sensitive info in resource not removed before reuse
Exploitation Conditions

Requires Eclipse Jetty with JASPI (Java Authentication and Authorization Service Provider Interface) authentication enabled. Attacker exploits thread pool reuse by sending crafted requests that trigger early returns from JASPIAuthenticator without ThreadLocal cleanup. Subsequent requests on the same thread inherit leaked authentication state. Remote, unauthenticated exploitation possible against vulnerable JASPI configurations.
Impact

The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N indicates network-accessible exploitation requiring no authentication or user interaction, but with high attack complexity. The AC:H rating likely reflects the need for precise timing to have a subsequent request land on the same thread immediately after a failed authentication that triggers the early return path. Impact is high for confidentiality and integrity (privilege escalation to access protected resources), but no availability impact. No EPSS score or KEV status was provided in the intelligence data, limiting quantitative exploitation probability assessment. No public exploit identified at time of analysis, though the vulnerability mechanism (ThreadLocal pollution in servlet containers) is a well-understood attack pattern. The broad version range (9.4.0 through 12.1.7 spanning multiple major releases) significantly expands the attack surface. Real-world risk is elevated for internet-facing Jetty deployments using JASPIC authentication, particularly high-traffic environments where thread reuse is frequent. The high complexity may reduce exploitation likelihood compared to simpler authentication bypasses, but privilege escalation combined with network accessibility without authentication makes this a genuine priority for affected deployments.
Exploit ScenarioDerived

An attacker sends a specially crafted authentication request to a Jetty server using JASPIC authentication that triggers an early return from JASPIAuthenticator without clearing ThreadLocal state. Immediately after, the attacker or another user sends a legitimate request that happens to be processed by the same pooled thread. This subsequent request inherits the polluted ThreadLocal authentication context, potentially granting unauthorized access to protected resources or administrative functions. The attacker could repeat this process to probabilistically gain elevated privileges, with success rate dependent on thread pool utilization and request timing. No public exploit identified at time of analysis, though the ThreadLocal pollution attack pattern is documented in servlet container security research.
This Week Schedule remediation this week. Why: HIGH severity (CVSS 7.0-8.9).
Patch available 0.0% exploitation probability (EPSS)

Get an e-mail when this CVE is exploited, patched or re-scored. Free account.

Alert me

AnalysisAIv1 – Apr 08, 2026

Privilege escalation in Eclipse Jetty 9.4.0-12.1.7 allows unauthenticated remote attackers to bypass authentication via ThreadLocal variable pollution in JASPIAuthenticator. Early returns from authentication checks fail to clear ThreadLocal values, causing subsequent requests on the same thread to inherit elevated privileges. CVSS 7.4 with high complexity but no authentication required. EPSS and KEV status not provided; no public exploit identified at time of analysis. Affects all major Jetty versions from 9.x through 12.x.

RemediationAI

Upgrade to patched Eclipse Jetty versions that properly clear ThreadLocal variables in all JASPIAuthenticator code paths. Consult the official vendor security advisory at github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c for exact fixed versions corresponding to each affected major release branch (specific patch versions not provided in available intelligence data). As an interim mitigation if immediate patching is not feasible, consider disabling JASPIC authentication and switching to alternative authentication mechanisms, though this may require application refactoring. Review access logs for anomalous privilege escalation patterns, particularly authenticated actions immediately following failed authentication attempts on the same connection. Implement additional authorization checks at the application layer as defense-in-depth. Refer to Eclipse GitLab issue gitlab.eclipse.org/security/cve-assignment/-/issues/92 for upstream technical details and patch commit references.

Affected VersionsENISA

Eclipse Jetty 10.0.0 ≤10.0.28
Eclipse Jetty 9.4.0 ≤9.4.60
Eclipse Jetty 11.0.0 ≤11.0.28
Eclipse Jetty 12.0.0 ≤12.0.33
Eclipse Jetty 12.1.0 ≤12.1.7

Affected Packages

maven org.eclipse.jetty.ee10:jetty-ee10 fix: 9.4.60, 10.0.28, 11.0.28, 12.0.33, 12.1.7
maven org.eclipse.jetty.ee10:jetty-ee10-jaspi fix: 12.0.34, 12.1.8
maven org.eclipse.jetty.ee11:jetty-ee11-jaspi fix: 12.0.34, 12.1.8
maven org.eclipse.jetty.ee8:jetty-ee8-jaspi fix: 12.0.34, 12.1.8
maven org.eclipse.jetty.ee9:jetty-ee9-jaspi fix: 12.0.34, 12.1.8
maven org.eclipse.jetty:jetty-jaspi fix: 9.4.61, 10.0.29, 11.0.29
euvd eclipse_jetty no fix

Source: OSV (Open Source Vulnerabilities)

Affects your stack

Affects 7 packages in maven, euvd

Checking this CVE against your own stacks and servers is part of the Basic plan and up.

Sign in to check
Technical ContextAI · show details

Eclipse Jetty's JASPIAuthenticator class implements Java Authentication Service Provider Interface for Containers (JASPIC) authentication flows. During authentication checks, the authenticator sets ThreadLocal variables to maintain request-scoped authentication state. CWE-226 (Sensitive Information in Resource Not Removed Before Reuse) describes the root cause: certain code paths trigger early returns without properly clearing these ThreadLocals. In servlet containers like Jetty that use thread pooling for request handling, threads are reused across multiple HTTP requests. When ThreadLocal cleanup fails, the next request handled by that thread inherits the previous request's authentication context, including potentially elevated privileges. This represents a classic thread reuse vulnerability where security-critical state bleeds between requests due to improper resource cleanup in authentication middleware.

Know when Eclipse Jetty gets its next vulnerability

  • Watch products and get an email when something new is published
  • Check this CVE against your own stack and servers
  • Exploit and PoC references, threat intelligence from 22 sources
Continue with Google Continue with GitHub

No credit card · 7-day full trial

Severity by source

Vendor (eclipse) PRIMARY 7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE HIGH
Red Hat 7.4 HIGH

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

2
Patch released
Apr 09, 2026 - 02:30 nvd
Patch available
CVE Published
Apr 08, 2026 - 13:32 nvd
HIGH 7.4

DescriptionCVE.org

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.

Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.

A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

Executive ViewAI

Why It Matters

Eclipse Jetty versions 9.4.0 through 12.1.7 contain a privilege escalation vulnerability that allows unauthenticated attackers to bypass authentication controls through ThreadLocal variable pollution, potentially granting unauthorized access to protected resources. This affects organizations running affected Jetty versions in multi-threaded environments where request handling reuses threads, creating a path for attackers to inherit elevated privileges from previous authenticated sessions.

Business Impact: High
Compensating Controls

No vendor-released patch identified at time of analysis. Interim mitigations: (1) Implement dedicated ThreadLocal cleanup in authentication filters by extending JASPIAuthenticator to explicitly clear all ThreadLocal values on authentication completion; (2) Configure Jetty thread pools to avoid thread reuse across security boundaries using separate executor services per authentication context; (3) Disable persistent thread pools and force thread-per-request model if performance permits; (4) Enforce strict session timeout policies and implement request-level authentication re-validation to reduce window of privilege inheritance.

Threat Intelligence Overview

EPSS Score
0.0%
Top 96% exploitable
Threat Intel
2
1 source
Social Media
1
Sightings
Data Quality
8 sources
Confidence: High
EUVD NVD CVE.org EPSS Vulnrichment GHSA Vendor CIRCL GitHub VulDB

How this decision was reached

The engine reads each signal below and applies a fixed list of rules from top to bottom. The first rule that matches sets the recommended action – like a statement, every line is shown.

SignalValue
Severity HIGH
CISA KEV No
Public POC No
EPSS 0.0%
Patch available Yes
Active threat No
Deciding rule
HIGH severity (CVSS 7.0-8.9)
What every action level means
Emergency Immediate action required. Criteria: CRITICAL + in CISA KEV (actively exploited) without patch, OR CRITICAL + EPSS > 30% without patch, OR CRITICAL + active threat signals without patch.
Act Now Prioritize within 24-48h. Criteria: in KEV with patch available, OR CRITICAL + public POC, OR HIGH + EPSS > 10%, OR CRITICAL + active threat, OR any CRITICAL severity.
This Week Schedule remediation this week. Criteria: HIGH severity (CVSS 7.0-8.9). Patch within normal change window.
This Month Plan within 30 days. Criteria: MEDIUM severity (CVSS 4.0-6.9), lower exploitation probability. Include in regular patch cycle.
Monitor Track and reassess. Criteria: LOW severity (CVSS 0.1-3.9), minimal exploitation risk. No immediate action needed.

SSVC AssessmentENISA

SSVC Decision
Scheduled
Exploitation
None
System Exposure· derived
Open
Automatable
No
Human Impact
High
Technical Impact
Total

Priority Score

37
Low Medium High Critical
KEV: 0
EPSS: 0
CVSS: +37
PoC: 0
Weaponized: 0
Threat intel: 0
Gov advisory: 0

Attack Technique

Privilege Escalation HIGH

Privilege escalation occurs when an attacker leverages flaws in access control mechanisms to gain permissions beyond what they were originally granted.

More in Eclipse Jetty

View all
CVE-2026-2332 CRITICAL
9.1 Apr 14

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote unauthenticated attackers desynchronize front-end/
CVE-2026-18661 HIGH
8.8 Oct 15

Security-constraint bypass in Eclipse Jetty leaves some request URL patterns unprotected when annotation and deployment-
CVE-2026-19204 HIGH
8.7 Sep 07

Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible clien
CVE-2026-12611 HIGH
8.7 Sep 08

HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block a
CVE-2026-19203 HIGH
8.3 Sep 08

HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary pa
CVE-2026-77711 HIGH
8.2 Oct 15

Eclipse Jetty's HttpClient can disclose proxy authentication credentials to a malicious server when the server returns a
CVE-2026-76184 HIGH
8.2 Oct 15

Path-normalization weakness in Eclipse Jetty's HttpClient causes credential disclosure: when HttpClient receives a redir
CVE-2026-76182 MEDIUM
6.9 Oct 15

Query-parameter injection in Eclipse Jetty's TryPathsHandler and TryFilesFilter allows unauthenticated remote attackers

CVE-2026-10051 MEDIUM
6.9 Jul 14

HTTP/1.1 trailer leakage in Eclipse Jetty allows a remote unauthenticated attacker to read trailer headers from a previo
CVE-2026-6790 MEDIUM
5.3 Jul 14

Eclipse Jetty fails to enforce RFC 9110/9112's requirement that the HTTP request authority (host and port) match the val
CVE-2026-8384 MEDIUM
5.3 Jul 14

Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an

Same weakness CWE-226 – Sensitive Information in Resource Not Removed Before Reuse

View all
CVE-2019-25560 HIGH POC
8.7
CVE-2019-25617 MEDIUM POC
6.9
CVE-2019-25571 MEDIUM POC
6.9
CVE-2019-25553 MEDIUM POC
6.9
CVE-2019-25657 MEDIUM POC
6.8
CVE-2019-25645 MEDIUM POC
6.2
CVE-2019-25563 MEDIUM POC
6.2
CVE-2026-74791 CRITICAL
9.2

Same technique Privilege Escalation

View all
CVE-2024-0012 CRITICAL POC
9.3
CVE-2025-47812 CRITICAL POC
10.0
CVE-2013-0422 CRITICAL POC
9.8
CVE-2013-0632 CRITICAL POC
9.8
CVE-2024-9474 MEDIUM POC
6.9
CVE-2017-5689 CRITICAL POC
9.8
CVE-2021-20021 CRITICAL POC
9.8
CVE-2017-12635 CRITICAL POC
9.8

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

References

Advisories & patches
ADVISORY https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf ADVISORY https://nvd.nist.gov/vuln/detail/CVE-2026-5795 ADVISORY https://vuldb.com/vuln/356235 ADVISORY https://www.herodevs.com/vulnerability-directory/cve-2026-5795 REF https://access.redhat.com/errata/RHSA-2026:17668 REF https://access.redhat.com/errata/RHSA-2026:25089 REF https://access.redhat.com/errata/RHSA-2026:28573 REF https://access.redhat.com/security/cve/CVE-2026-5795 REF https://bugzilla.redhat.com/show_bug.cgi?id=2456519 REF https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps:// REF https://gitlab.eclipse.org/security/cve-assignment/-/issues/92 REF https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5795.json

Search Externally

GitHub PoC Exploit-DB PacketStorm Snyk Rapid7 Nuclei Templates Trickest PoC
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy