Bug 2499932 (CVE-2026-8384) - CVE-2026-8384 jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications
Summary: CVE-2026-8384 jetty: Eclipse Jetty: Path confusion vulnerability may lead to ...
Keywords:
Status: NEW
Alias: CVE-2026-8384
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 2511534 2511535 2511536
Blocks:
TreeView+ depends on / blocked
 
Reported: 2026-07-14 10:01 UTC by OSIDB Bzimport
Modified: 2026-08-05 13:43 UTC (History)
82 users (show)

Fixed In Version:
Clone Of:
Environment:
Last Closed:
Embargoed:

Attachments (Terms of Use)

Description OSIDB Bzimport 2026-07-14 10:01:42 UTC 
In Eclipse Jetty, an HTTP URI of this form:





/public;/../admin/secret.txt








results in an unresolved path of:





/public/../admin/secret.txt








instead of the expected:





/admin/secret.txt








Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).




However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.
Note You need to log in before you can comment on or make changes to this bug.