CVE-2026-76182

MediumCVSS 6.9/10Last modified Oct 15, 2026

Description

In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.

However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.

Metrics

CVSS 4.0 6.9/10CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Weakness enumeration

CWE-74

Affected software

Source: the vendor's advisory (CNA). NVD analysis pending.

VendorProductVersions
Eclipse FoundationEclipse Jetty>= 12.1.0, <= 12.1.12; >= 12.0.0, <= 12.0.38
Eclipse FoundationEclipse Jetty>= 12.1.0, <= 12.1.12
Eclipse FoundationEclipse Jetty>= 12.1.0, <= 12.1.12; >= 12.0.0, <= 12.0.38
Eclipse FoundationEclipse Jetty>= 12.1.0, <= 12.1.12; >= 12.0.0, <= 12.0.38
Eclipse FoundationEclipse Jetty>= 11.0.0, <= 11.0.32; >= 10.0.0, <= 10.0.32; >= 9.4.0, <= 9.4.64
Eclipse FoundationEclipse Jetty>= 12.1.0, <= 12.1.12; >= 12.0.0, <= 12.0.38

References

Timeline

Published
Oct 15, 2026
Last modified
Oct 15, 2026
NVD status
Awaiting Analysis

Related CVEs from 2026

CVE-2026-761839.8Authentication Bypass by Alternate Name vulnerability in Apache Tomcat allowed the security constraints for any WebSocket endpoint to be bypCVE-2026-761848.2In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ``` If an attacker is able to control the rCVE-2026-761856.5Apache Airflow's Task SDK secret cache built its keys from the team name and secret id with unescaped `_` delimiters, so different (team, seCVE-2026-761869.1Apache Airflow Keycloak provider: from Airflow 3.3 the Keycloak auth manager takes a user's identity from the signed Airflow session token bCVE-2026-761879.8Apache Airflow Keycloak provider: the unauthenticated token endpoint accepts a client-credentials grant for any confidential client registerCVE-2026-761896.2CAI Content Credentials is affected by an Integer Underflow (Wrap or Wraparound) vulnerability that could result in an application denial-ofCVE-2026-76196.5The Charitable – Donation Plugin for WordPress – Fundraising with Recurring Donations & More plugin for WordPress is vulnerable to generic SCVE-2026-761908.6ColdFusion is affected by an Improper Neutralization of Directives in Dynamically Evaluated Code ('Eval Injection') vulnerability that couldCVE-2026-761918.2Animate is affected by an Improper Control of Generation of Code ('Code Injection') vulnerability that could result in arbitrary code executCVE-2026-761925.5InDesign Desktop is affected by a NULL Pointer Dereference vulnerability that could result in an application denial-of-service. An attacker CVE-2026-7619310.0Adobe Campaign Classic (ACC) is affected by a Server-Side Request Forgery (SSRF) vulnerability that could result in arbitrary code executionCVE-2026-761944.3CAI Content Credentials is affected by an Improper Input Validation vulnerability that could result in a Security feature bypass. An attacke