Skip to main content

Eclipse Jetty EUVDEUVD-2026-20473

| CVE-2026-5795 HIGH
Sensitive Information in Resource Not Removed Before Reuse (CWE-226)
2026-04-08 eclipse GHSA-gc59-r5jq-98qw GHSA-r7p8-xq5m-436c
Privilege Escalation Eclipse Jetty
7.4
CVSS 3.1 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
7.4 HIGH
AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
SUSE
HIGH
qualitative
Red Hat
7.4 HIGH
qualitative

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Attack Vector
Network
Attack Complexity
High
Privileges Required
None
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
None

Lifecycle Timeline

5
Re-analysis Queued
Apr 23, 2026 - 12:07 vuln.today
cvss_changed
Patch released
Apr 09, 2026 - 02:30 nvd
Patch available
EUVD ID Assigned
Apr 08, 2026 - 14:16 euvd
EUVD-2026-20473
Analysis Generated
Apr 08, 2026 - 14:16 vuln.today
CVE Published
Apr 08, 2026 - 13:32 nvd
HIGH 7.4

DescriptionCVE.org

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.

Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.

A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

AnalysisAI

Privilege escalation in Eclipse Jetty 9.4.0-12.1.7 allows unauthenticated remote attackers to bypass authentication via ThreadLocal variable pollution in JASPIAuthenticator. Early returns from authentication checks fail to clear ThreadLocal values, causing subsequent requests on the same thread to inherit elevated privileges. …

Unlock full vulnerability intelligence

  • Risk assessment & exploitation conditions
  • Attack chain visualization
  • Remediation with exact patch versions
  • Threat intelligence from 22 sources
  • Personal watchlist & email alerts
Continue with Google Continue with GitHub

Free forever · No credit card required

Attack ChainAIDerived

Hypothetical attack flow derived from CVE metadata

Access
Send initial request triggering early return
Delivery
ThreadLocal variables remain uncleared
Exploit
Reuse same thread for subsequent request
Execution
Inherit privileged ThreadLocal context
Impact
Bypass access controls and escalate privileges
Sign in to reveal

Vulnerability AssessmentAI

Exploitation Requires Eclipse Jetty with JASPI (Java Authentication and Authorization Service Provider Interface) authentication enabled. … Additional conditions and limiting factors are described in the full assessment.
Risk Assessment The CVSS vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N indicates network-accessible exploitation requiring no authentication or user interaction, but with high attack complexity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in.
Exploit Scenario An attacker sends a specially crafted authentication request to a Jetty server using JASPIC authentication that triggers an early return from JASPIAuthenticator without clearing ThreadLocal state. Immediately after, the attacker or another user sends a legitimate request that happens to be processed by the same pooled thread. …
Remediation Upgrade to patched Eclipse Jetty versions that properly clear ThreadLocal variables in all JASPIAuthenticator code paths. … Detailed patch versions, workarounds, and compensating controls in full report.
Sign in to read full assessment

Recommended ActionAI

Within 24 hours: Inventory all Eclipse Jetty deployments and identify instances running versions 9.4.0-12.1.7; document thread pool configurations and authentication mechanisms in use. …

Sign in for detailed remediation steps and compensating controls.

Threat intelligence, references, and detailed analysis are available after sign-in.

More in Eclipse Jetty

View all
CVE-2026-2332 CRITICAL
9.1 Apr 14

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote unauthenticated attackers desynchronize front-end/

Same weakness CWE-226 – Sensitive Information in Resource Not Removed Before Reuse

View all
CVE-2019-25560 HIGH POC
8.7
CVE-2026-32960 HIGH
7.1
CVE-2025-0647 HIGH
7.9
CVE-2025-2522 MEDIUM
6.5
CVE-2025-13108 MEDIUM
5.5
CVE-2025-14858 MEDIUM
5.1
CVE-2025-33196 MEDIUM
4.4
CVE-2025-33198 LOW
3.3

Same technique Privilege Escalation

View all
CVE-2025-47812 CRITICAL POC
10.0
CVE-2025-11749 CRITICAL POC
9.8
CVE-2025-27007 CRITICAL POC
9.8
CVE-2025-2563 HIGH POC
8.1
CVE-2025-20281 CRITICAL POC
10.0
CVE-2016-0051 HIGH POC
7.8
CVE-2014-4076 HIGH POC
7.2
CVE-2026-22769 CRITICAL
10.0

Vendor StatusVendor

SUSE

Severity: High
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Fixed
SUSE Linux Enterprise High Performance Computing 15 SP7 Fixed
SUSE Linux Enterprise Module for Development Tools 15 SP7 Fixed
SUSE Linux Enterprise Module for Package Hub 15 SP7 Fixed
SUSE Linux Enterprise Server 15 SP7 Fixed

Share

EUVD-2026-20473 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy