CVE-2026-8384
Fixed in a distro release EPSS <1%CVSS 5.3
In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
Products: Eclipse Foundation Eclipse Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty:jetty-util | 12.0.35 |
| Maven | org.eclipse.jetty:jetty-util | 12.1.9 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | akhq | 0.27.1-r15 |
| Chainguard | apache-hop | 2.18.1-r16 |
| Chainguard | apache-hop-fips | 2.18.1-r8 |
| Chainguard | apache-jena-fuseki | 6.2.0-r1 |
| Chainguard | confluent-kafka | 8.4.0.397-r0 |
| Chainguard | confluent-kafka-jre-bcfips | 8.4.0.382-r0 |
| Chainguard | dependency-track | 4.14.3-r0 |
| Chainguard | dependency-track-bundled | 4.14.3-r0 |
| Chainguard | druid | 37.0.0-r47 |
| Chainguard | druid | 37.0.0-r56 |
| Chainguard | jenkins-2.541 | no fix |
| Chainguard | jenkins-2.541-openjdk-17 | no fix |
| Chainguard | jenkins-2.541-openjdk-21 | no fix |
| Chainguard | jenkins-2.541-openjdk-25 | no fix |
| Chainguard | jenkins-2.555 | no fix |
| Chainguard | jenkins-2.555-openjdk-21 | no fix |
| Chainguard | jenkins-2.555-openjdk-25 | no fix |
| Chainguard | jenkins-2.568 | 2.568.1-r1 |
| Chainguard | jenkins-2.568-openjdk-21 | 2.568.1-r1 |
| Chainguard | jenkins-2.568-openjdk-25 | 2.568.1-r1 |
| Chainguard | kafka-4.0 | 4.0.2-r7 |
| Chainguard | kafka-fips-4.3 | 4.3.1-r3 |
| Chainguard | kafka-strimzi-compat | no fix |
| Chainguard | kafka-strimzi-compat | 1.2.0-r5 |
| Chainguard | kafka_exporter-strimzi-compat | 1.2.0-r5 |
| Chainguard | kafka_exporter-strimzi-compat | 1.2.0-r4 |
| Chainguard | neo4j-2025.12 | no fix |
| Chainguard | neo4j-2026.01 | no fix |
| Chainguard | neo4j-2026.02 | no fix |
| Chainguard | neo4j-2026.03 | 2026.03.1-r1 |
| Chainguard | neo4j-2026.04 | no fix |
| Chainguard | neo4j-2026.05 | no fix |
| Chainguard | neo4j-2026.06 | 2026.06.0-r3 |
| Chainguard | neo4j-5.26 | 5.26.28-r3 |
| Chainguard | prometheus-jmx-exporter-strimzi-compat | 1.6.0-r0 |
| Chainguard | reposilite | 3.6.2-r2 |
| Chainguard | solr-10 | 10.0.0-r8 |
| Chainguard | solr-10-iamguarded-compat | 10.0.0-r8 |
| Chainguard | solr-fips-10 | 10.0.0-r2 |
| Chainguard | solr-fips-10-iamguarded-compat | 10.0.0-r2 |
| Chainguard | spark-4.2-scala-2.13 | 4.2.0-r1 |
| Chainguard | spark-fips-4.2-scala-2.13 | 4.2.0-r1 |
| Chainguard | spark-kubernetes-operator | 1.0.0-r0 |
| Chainguard | spark-kubernetes-operator-fips | 1.0.0-r0 |
| Chainguard | strimzi-kafka-operator | no fix |
| Chainguard | strimzi-kafka-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-cluster-operator | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-cluster-operator | 1.1.0-r4 |
| Chainguard | strimzi-kafka-operator-cluster-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-fips-cluster-operator | 1.1.0-r1 |
| Chainguard | strimzi-kafka-operator-fips-kafka-agent | 1.1.0-r1 |
| Chainguard | strimzi-kafka-operator-fips-kafka-init | 1.1.0-r1 |
| Chainguard | strimzi-kafka-operator-fips-topic-operator | 1.1.0-r1 |
| Chainguard | strimzi-kafka-operator-fips-tracing-agent | 1.1.0-r1 |
| Chainguard | strimzi-kafka-operator-fips-user-operator | 1.1.0-r1 |
| Chainguard | strimzi-kafka-operator-kafka-agent | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-agent | no fix |
| Chainguard | strimzi-kafka-operator-kafka-agent | 1.1.0-r4 |
| Chainguard | strimzi-kafka-operator-kafka-base | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-base | no fix |
| Chainguard | strimzi-kafka-operator-kafka-init | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-init | 1.1.0-r4 |
| Chainguard | strimzi-kafka-operator-kafka-init | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-topic-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-topic-operator | 1.1.0-r4 |
| Chainguard | strimzi-kafka-operator-topic-operator | 1.2.0-r4 |
| Chainguard | strimzi-kafka-operator-tracing-agent | 1.1.0-r4 |
| Chainguard | strimzi-kafka-operator-tracing-agent | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-user-operator | 1.2.0-r5 |
| Chainguard | strimzi-kafka-operator-user-operator | 1.1.0-r4 |
| Chainguard | traccar | 6.14.5-r1 |
| Chainguard | traccar-fips | 6.14.5-r3 |
| Chainguard | trino | no fix |
| Chainguard | trino-plugin-bigquery | no fix |
| Chainguard | trino-plugin-opensearch | 483-r7 |
| Chainguard | trino-plugin-oracle | 483-r7 |
| Chainguard | trino-plugin-ranger | 483-r1 |
| Chainguard | trino-plugin-teradata-functions | no fix |
| Chainguard | wso2is | 7.3.0-r5 |
| Debian 12 | jetty9 | no fix |
| Debian 13 | jetty12 | no fix |
| Debian 13 | jetty9 | no fix |
| Debian 14 | jetty12 | no fix |
| Debian 14 | jetty9 | no fix |
| Ubuntu 16.04 LTS | jetty9 | no fix |
| Ubuntu 18.04 LTS | jetty9 | no fix |
| Ubuntu 20.04 LTS | jetty9 | no fix |
| Ubuntu 22.04 LTS | jetty9 | no fix |
| Ubuntu 24.04 LTS | jetty9 | no fix |
| Ubuntu 26.04 LTS | jetty12 | no fix |
| Ubuntu 26.04 LTS | jetty9 | no fix |
| Ubuntu 26.10 | jetty12 | no fix |
| Ubuntu 26.10 | jetty9 | no fix |
| Wolfi | akhq | 0.27.1-r15 |
| Wolfi | confluent-kafka | 8.4.0.397-r0 |
| Wolfi | dependency-track | 4.14.3-r0 |
| Wolfi | dependency-track-bundled | 4.14.3-r0 |
| Wolfi | druid | 37.0.0-r47 |
| Wolfi | druid | 37.0.0-r56 |
| Wolfi | kafka-strimzi-compat | 1.2.0-r5 |
| Wolfi | kafka-strimzi-compat | no fix |
| Wolfi | kafka_exporter-strimzi-compat | 1.2.0-r5 |
| Wolfi | kafka_exporter-strimzi-compat | 1.2.0-r4 |
| Wolfi | neo4j-2025.12 | no fix |
| Wolfi | neo4j-2026.01 | no fix |
| Wolfi | neo4j-2026.05 | no fix |
| Wolfi | neo4j-2026.06 | 2026.06.0-r3 |
| Wolfi | prometheus-jmx-exporter-strimzi-compat | 1.6.0-r0 |
| Wolfi | solr-10 | 10.0.0-r8 |
| Wolfi | solr-10-iamguarded-compat | 10.0.0-r8 |
| Wolfi | strimzi-kafka-operator | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator | no fix |
| Wolfi | strimzi-kafka-operator-cluster-operator | 1.1.0-r4 |
| Wolfi | strimzi-kafka-operator-cluster-operator | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-cluster-operator | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-kafka-agent | 1.1.0-r4 |
| Wolfi | strimzi-kafka-operator-kafka-agent | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-agent | no fix |
| Wolfi | strimzi-kafka-operator-kafka-base | no fix |
| Wolfi | strimzi-kafka-operator-kafka-base | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-init | 1.1.0-r4 |
| Wolfi | strimzi-kafka-operator-kafka-init | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-init | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-kafka-thirdparty-libs-cc | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-topic-operator | 1.2.0-r4 |
| Wolfi | strimzi-kafka-operator-topic-operator | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-topic-operator | 1.1.0-r4 |
| Wolfi | strimzi-kafka-operator-tracing-agent | 1.1.0-r4 |
| Wolfi | strimzi-kafka-operator-tracing-agent | 1.2.0-r5 |
| Wolfi | strimzi-kafka-operator-user-operator | 1.1.0-r4 |
| Wolfi | strimzi-kafka-operator-user-operator | 1.2.0-r5 |
| Wolfi | trino | no fix |
| Wolfi | trino-plugin-bigquery | no fix |
| Wolfi | trino-plugin-opensearch | 483-r7 |
| Wolfi | trino-plugin-oracle | 483-r7 |
| Wolfi | trino-plugin-ranger | 483-r1 |
| Wolfi | trino-plugin-teradata-functions | no fix |