CVE-2026-76182
Description
A flaw was found in Eclipse Jetty. When configured to forward requests to template Uniform Resource Identifiers (URIs) using TryPathsHandler or TryFilesFilter, path values are not properly encoded before substitution into query strings. A remote attacker can exploit this flaw by sending requests containing reserved URI characters, resulting in query parameter injection that may alter application behavior and compromise data integrity.
Statement
A flaw was found in org.eclipse.jetty/jetty-server, org.eclipse.jetty.ee10/jetty-ee10-servlets, org.eclipse.jetty.ee9/jetty-ee9-servlets, org.eclipse.jetty.ee8/jetty-ee8-servlets. In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context.
However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the template becomes index?p=/s&a=1, which is interpreted as 2 query parameters: p=/s and a=1, rather than just one query parameter p whose value is /s&a=1.
Prerequisites: Standard deployment configuration
CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). None -- NVD score appropriate
Exploitation scenario: No exploitation steps identified. Exploitation difficulty: MEDIUM.
This issue affects amq-7, exploit-intelligence, fedora-all, fuse-7, ocp-tools-4, offline-knowledge-portal-1, openshift-ai, openshift-hosted-osd4, rhboac-hawtio-4, rhel-10, rhel-7, rhel-8, rhel-9, rhel-br-10, rhel-br-8, rhel-br-9, rhint-camel-spring-boot-4, rhint-debezium-3, rhint-serv-3, rhivos-2, rhivos-core-2, rhn_satellite_6, rhos_devspaces-3, services-management-platform, services-remediations-platform. Red Hat has rated this as having moderate impact.
Mitigation
Red Hat recommends updating org.eclipse.jetty/jetty-server, org.eclipse.jetty.ee10/jetty-ee10-servlets, org.eclipse.jetty.ee9/jetty-ee9-servlets, org.eclipse.jetty.ee8/jetty-ee8-servlets to the latest version when a fix is available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.3 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | Low | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | None | N/A | N/A |
| Integrity Impact | Low | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
Understanding the Weakness (CWE)
Integrity
Technical Impact: Unexpected State
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
