Bug 2553117 (CVE-2026-76182)

Summary: CVE-2026-76182 org.eclipse.jetty/jetty-server: org.eclipse.jetty.ee10/jetty-ee10-servlets: org.eclipse.jetty.ee9/jetty-ee9-servlets: org.eclipse.jetty.ee8/jetty-ee8-servlets: Eclipse Jetty: Query parameter injection via unescaped URI paths
Product: [Other] Security Response Reporter: OSIDB Bzimport <bzimport>
Component: vulnerabilityAssignee: Product Security DevOps Team <prodsec-dev>
Status: NEW --- QA Contact:
Severity: medium Docs Contact:
Priority: medium    
Version: unspecifiedCC: abrianik, anthomas, asyoung, ataylor, ccranfor, csuconic, dbruscin, dfreiber, drow, ehelms, ewittman, fmariani, ggainey, ggrzybek, gmalinko, gtully, janstey, jburrell, jhollowa, jpasqual, jpechane, jraez, jsherman, juwatts, jwon, kaycoth, kvanderr, mcarlett, mdellweg, mhulan, nipatil, nmoumoul, osousa, pantinor, parichar, pcreech, pdelbell, pjindal, prichard, rchan, rgemmell, rgodfrey, rhel-process-autobot, rkubis, rstepani, sdawley, smallamp, sthirugn, tasato, tbish, tcunning, tlavocat, tmalecek, vkumar, watson-tool-maintainers, yfang
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: ---
Doc Text:
A flaw was found in Eclipse Jetty. When configured to forward requests to template Uniform Resource Identifiers (URIs) using TryPathsHandler or TryFilesFilter, path values are not properly encoded before substitution into query strings. A remote attacker can exploit this flaw by sending requests containing reserved URI characters, resulting in query parameter injection that may alter application behavior and compromise data integrity.
 Story Points: ---
Clone Of: Environment:
Last Closed: Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-15 08:52:03 UTC 
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.



However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.