Bug 2553118 (CVE-2026-76184)

Summary:	CVE-2026-76184 org.eclipse.jetty/jetty-client: org.eclipse.jetty/jetty-http-tools: jetty-client: Information disclosure via improper redirect path normalization
Product:	[Other] Security Response	Reporter:	OSIDB Bzimport <bzimport>
Component:	vulnerability	Assignee:	Product Security DevOps Team <prodsec-dev>
Status:	NEW ---	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	abrianik, anthomas, asyoung, ccranfor, dfreiber, drow, ehelms, ewittman, fmariani, fmongiar, ggainey, ggrzybek, gmalinko, janstey, jburrell, jhollowa, jnethert, jpasqual, jpechane, jraez, juwatts, jwon, kaycoth, mcarlett, mdellweg, mhulan, nipatil, nmoumoul, osousa, pantinor, parichar, pcreech, pdelbell, pjindal, prichard, rchan, rhel-process-autobot, rkubis, rstepani, sdawley, smallamp, sthirugn, tasato, tcunning, tmalecek, vkumar, watson-tool-maintainers, yfang
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	---
Doc Text:	A flaw was found in Eclipse Jetty's HttpClient. When handling HTTP redirects containing path traversal sequences, the client fails to normalize the destination path before matching stored authentication credentials. A remote attacker who controls redirect responses can exploit this issue to cause the client to transmit sensitive authorization headers to an unintended endpoint on the same domain, leading to information disclosure.	Story Points:	---
Clone Of:		Environment:
Last Closed:		Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description OSIDB Bzimport 2026-10-15 09:02:26 UTC

In Eclipse Jetty, HttpClient may receive a redirect of the form:



```



/secure/../evil



```



If an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.



This also mean that the attacker must have an evil application deployed on the same domain as the target.