CVE-2026-76184
Description
A flaw was found in Eclipse Jetty's HttpClient. When handling HTTP redirects containing path traversal sequences, the client fails to normalize the destination path before matching stored authentication credentials. A remote attacker who controls redirect responses can exploit this issue to cause the client to transmit sensitive authorization headers to an unintended endpoint on the same domain, leading to information disclosure.
Statement
A flaw was found in org.eclipse.jetty/jetty-client, org.eclipse.jetty/jetty-http-tools. In Eclipse Jetty, HttpClient may receive a redirect of the form:
/secure/../evil
If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the Authorization header for /secure to /evil.
This also mean that the attacker must have an evil application deployed on the same domain as the target. Prerequisites: Standard deployment configuration CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). None -- NVD score appropriate Exploitation scenario: No exploitation steps identified. Exploitation difficulty: MEDIUM. This issue affects fedora-all, fuse-7, offline-knowledge-portal-1, openshift-ai, openshift-hosted-osd4, rhboac-camel-quarkus-3, rhboac-hawtio-4, rhel-7, rhel-9, rhint-camel-spring-boot-4, rhint-debezium-3, rhint-serv-3, rhn_satellite_6, rhos_devspaces-3, services-management-platform, services-remediations-platform. Red Hat has rated this as having moderate impact.
Mitigation
Red Hat recommends updating org.eclipse.jetty/jetty-client, org.eclipse.jetty/jetty-http-tools to the latest version when a fix is available.
Common Vulnerability Scoring System (CVSS) Score Details
Info alert:Important note
CVSS scores for open source components depend on vendor-specific factors (e.g. version or build chain). Therefore, Red Hat's score and impact rating can be different from NVD and other vendors. Red Hat remains the authoritative CVE Naming Authority (CNA) source for its products and services (see Red Hat classifications).
The following CVSS metrics and score provided are preliminary and subject to review.
CVSS v3 Score Breakdown
| Red Hat | NVD | cve.org | |
|---|---|---|---|
| Base Score | 5.9 | N/A | N/A |
| Attack Vector | Network | N/A | N/A |
| Attack Complexity | High | N/A | N/A |
| Privileges Required | None | N/A | N/A |
| User Interaction | None | N/A | N/A |
| Scope | Unchanged | N/A | N/A |
| Confidentiality | High | N/A | N/A |
| Integrity Impact | None | N/A | N/A |
| Availability Impact | None | N/A | N/A |
Vector
Red Hat: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N
Frequently Asked Questions
Not sure what something means? Check out our Security Glossary.
Want to get errata notifications? Sign up here.
