{"kind": "product", "path": "vulns/debian-13/jetty12", "name": "jetty12", "product": "jetty12", "ecosystem": "Debian:13", "items": [{"id": "CVE-2026-18659", "noindex": false, "published": "2026-10-15T09:44:11.148Z", "modified": "2026-10-15T13:26:19.435Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00412, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18659", "title": "Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring", "description": "In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-53x7-f9fc-h7qr", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/214", "https://nvd.nist.gov/vuln/detail/CVE-2026-18659"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-18662", "noindex": false, "published": "2026-10-15T09:42:40.638Z", "modified": "2026-10-15T13:28:30.423Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00388, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18662", "title": "CVE-2026-18662", "description": "In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.\n\n\n\nResulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-phjh-v7c6-g7mv", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/210", "https://nvd.nist.gov/vuln/detail/CVE-2026-18662"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-19864", "noindex": false, "published": "2026-10-15T09:41:25.133Z", "modified": "2026-10-15T13:29:54.581Z", "cvss": 5.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00097, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19864", "title": "CVE-2026-19864", "description": "Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext.\n\n\n\nAn attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-q6wx-j9wr-fj7f", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/229", "https://nvd.nist.gov/vuln/detail/CVE-2026-19864"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-18660", "noindex": false, "published": "2026-10-15T09:38:02.125Z", "modified": "2026-10-15T13:32:37.345Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00315, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18660", "title": "Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames", "description": "In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/212", "https://nvd.nist.gov/vuln/detail/CVE-2026-18660"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-18661", "noindex": false, "published": "2026-10-15T09:01:28.668Z", "modified": "2026-10-15T13:46:37.040Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00424, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18661", "title": "CVE-2026-18661", "description": "In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-v6xf-996f-c35f", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/211", "https://nvd.nist.gov/vuln/detail/CVE-2026-18661"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-77711", "noindex": false, "published": "2026-10-15T08:51:48.066Z", "modified": "2026-10-15T13:50:52.566Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-77711", "title": "CVE-2026-77711", "description": "When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).\n\n\n\nThe client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/238", "https://nvd.nist.gov/vuln/detail/CVE-2026-77711"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-76184", "noindex": false, "published": "2026-10-15T08:46:54.683Z", "modified": "2026-10-15T13:51:45.344Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00388, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-76184", "title": "CVE-2026-76184", "description": "In Eclipse Jetty, HttpClient may receive a redirect of the form:\n\n\n\n```\n\n\n\n/secure/../evil\n\n\n\n```\n\n\n\nIf an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.\n\n\n\nThis also mean that the attacker must have an evil application deployed on the same domain as the target.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/236", "https://nvd.nist.gov/vuln/detail/CVE-2026-76184"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-76182", "noindex": false, "published": "2026-10-15T08:40:58.439Z", "modified": "2026-10-15T13:59:12.521Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00345, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-76182", "title": "CVE-2026-76182", "description": "In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.\n\n\n\nHowever, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/237", "https://nvd.nist.gov/vuln/detail/CVE-2026-76182"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-12611", "noindex": false, "published": "2026-09-08T12:28:51.669Z", "modified": "2026-09-09T10:15:48.299Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00428, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12611", "title": "CVE-2026-12611", "description": "A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive.\n\n\n\n\nThis is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client.\n\n\n\n\nThe race condition \"resets\" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3", "https://nvd.nist.gov/vuln/detail/CVE-2026-12611"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-19203", "noindex": false, "published": "2026-09-08T12:08:37.576Z", "modified": "2026-09-08T14:21:55.816Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00509, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19203", "title": "CVE-2026-19203", "description": "A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.\n\n\n\n\nThis is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h", "https://nvd.nist.gov/vuln/detail/CVE-2026-19203"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-19204", "noindex": false, "published": "2026-09-07T10:19:24.186Z", "modified": "2026-09-08T15:06:46.810Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00454, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19204", "title": "CVE-2026-19204", "description": "A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.\n\n\n\n\nThis occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g", "https://nvd.nist.gov/vuln/detail/CVE-2026-19204"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-10050", "noindex": false, "published": "2026-08-04T11:02:40.503Z", "modified": "2026-08-04T12:46:38.770Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00632, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-10050", "title": "Digest authentication lossy encoding", "description": "In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server woul", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120", "https://nvd.nist.gov/vuln/detail/CVE-2026-10050"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2024-7708", "noindex": false, "published": "2026-07-14T09:01:53.869Z", "modified": "2026-07-14T12:17:11.635Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-7708", "title": "CVE-2024-7708", "description": "For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.", "references": ["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29", "https://nvd.nist.gov/vuln/detail/CVE-2024-7708"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-8384", "noindex": false, "published": "2026-07-14T08:56:17.525Z", "modified": "2026-07-14T12:18:29.831Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-8384", "title": "CVE-2026-8384", "description": "In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.", "references": ["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108", "https://nvd.nist.gov/vuln/detail/CVE-2026-8384"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-6790", "noindex": false, "published": "2026-07-14T08:51:30.527Z", "modified": "2026-07-14T12:20:35.130Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.0031, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6790", "title": "CVE-2026-6790", "description": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n  *  \n        \n      URI constructions (for example, for redirects -- this is typical for login pages)\n\n  *  \n        \n      Virtual host selection\n\n  *  \n        \n      Reverse proxying\n\n  *  \n        \n      Misleading logs\n\n  *  \n        \n      ", "references": ["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99", "https://nvd.nist.gov/vuln/detail/CVE-2026-6790"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-10051", "noindex": false, "published": "2026-07-14T08:44:38.233Z", "modified": "2026-07-14T12:57:50.096Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00429, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-10051", "title": "CVE-2026-10051", "description": "In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.\nSubsequent request that do not have trailers report the trailers of the first request.\nSubsequent request that do have trailers report the union of trailers of the first request and the current request.", "references": ["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119", "https://nvd.nist.gov/vuln/detail/CVE-2026-10051"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-2332", "noindex": false, "published": "2026-04-14T10:59:10.193Z", "modified": "2026-09-14T12:04:28.913Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.01305, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2332", "title": "HTTP Request Smuggling via Chunked Extension Quoted-String Parsing", "description": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf", "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89", "https://access.redhat.com/security/cve/CVE-2026-2332"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-5795", "noindex": false, "published": "2026-04-08T13:32:28.935Z", "modified": "2026-09-14T12:04:27.326Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00529, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-5795", "title": "CVE-2026-5795", "description": "In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps://", "https://gitlab.eclipse.org/security/cve-assignment/-/issues/92", "https://access.redhat.com/security/cve/CVE-2026-5795"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2026-1605", "noindex": false, "published": "2026-03-05T09:39:01.315Z", "modified": "2026-09-14T12:04:23.826Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00693, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-1605", "title": "CVE-2026-1605", "description": "In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.\n\n\nThis happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.\nIn this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f", "https://access.redhat.com/security/cve/CVE-2026-1605", "https://bugzilla.redhat.com/show_bug.cgi?id=2444815"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}, {"id": "CVE-2025-11143", "noindex": false, "published": "2026-03-05T09:26:59.830Z", "modified": "2026-03-05T14:48:41.622Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00165, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-11143", "title": "CVE-2025-11143", "description": "The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh", "https://nvd.nist.gov/vuln/detail/CVE-2025-11143"], "fixes": [], "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}]}], "total": 23, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "jetty12", "path": "vulns/debian-13/jetty12", "ecosystem": "Debian:13"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 8, "kev": 0}, "lastmod": "2026-10-15T13:59:12.521Z", "early_advisories": [], "license": "Vous pouvez librement utiliser la sélection de PatchFirst et nos ajouts (priorités, alertes précoces, textes, synthèses et agrégats) pour vos propres besoins, y compris les activités internes de votre entreprise. La revente, la distribution commerciale et la mise en miroir massive de cette sélection ou de ces ajouts nécessitent un accord écrit avec l’opérateur. Lors de toute utilisation ou publication de la sélection ou de nos ajouts, citez PatchFirst (https://patchfirst.dev/vulns/) avec ce lien vers la page du flux de votre région. Les enregistrements originaux des sources ouvertes restent soumis à leurs licences et conditions respectives. Ces conditions ne limitent pas vos droits sur les données originales, que vous pouvez obtenir directement auprès de ces sources.", "terms_url": "https://patchfirst.dev/fr/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst sélectionne, normalise et combine les enregistrements ; des synthèses et des traductions peuvent être ajoutées. Les actualités sont accompagnées d’un lien vers la source originale dans chaque entrée.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Les licences des bases d’origine varient ; voir le catalogue des sources."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Évaluations publiques gratuites ; mention de la source demandée (FIRST EPSS, évaluations produites par Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}