Cyber Resilience

CVE-2026-8384

Eclipse Jetty 12.0.0 – 12.0.35

Public PoC
Published
14 July 2026
Modified
14 July 2026
Patch / advisory
View advisory
CVSS Score v3.1 5.3
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS Score 0.0023 14th percentile
Risk Priority 35 floored blend · peak EPSS

Summary

CVE-2026-8384 is a medium-severity Use of Non-Canonical URL Paths for Authorization Decisions (CWE-647) vulnerability in Eclipse Jetty. Its CVSS base score is 5.3 (Medium).

Operationally, exploitation aligns with the MITRE ATT&CK technique Exploit Public-Facing Application (T1190); ranked at the 14th percentile by exploit likelihood (below the median); it is not currently listed in the CISA KEV catalog; a public proof-of-concept is referenced.

EU & UK References

Vulnerability Data

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass…

more

the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

CWE(s)
CWE-647

Related Threats

MITRE ATT&CK Enterprise TechniquesAI

T1190 Exploit Public-Facing Application Initial Access
Adversaries may attempt to exploit a weakness in an Internet-facing host or system to initially access a network.
attack.mitre.org →
Why these techniques?

Path normalization flaw (CWE-647) in public-facing Jetty server enables potential unauthorized file access or bypass in dependent web apps.

Confidence: MEDIUM · MITRE ATT&CK Enterprise v19.0

Likely ATT&CK TechniquesAI

Techniques this vulnerability likely enables, inferred from its description, weakness type, and attributed-actor tradecraft. Confidence is per-technique.

T1190 Exploit Public-Facing Application Initial Accessconfidence: HIGH
Path normalization flaw in public-facing Jetty server directly enables exploitation of dependent web apps via crafted URIs.
attack.mitre.org →
T1068 Exploitation for Privilege Escalation Privilege Escalationconfidence: MEDIUM
Unresolved paths can confuse authorization logic and grant unauthorized access to protected resources.
attack.mitre.org →
inferred from description + CWE · MITRE ATT&CK Enterprise v19.0

CVEs Like This One

CVE-2026-6790Same product: Eclipse Jetty
CVE-2026-2332Same product: Eclipse Jetty
CVE-2024-6763Same product: Eclipse Jetty
CVE-2026-10051Same product: Eclipse Jetty
CVE-2026-1605Same product: Eclipse Jetty
CVE-2026-5795Same product: Eclipse Jetty
CVE-2024-6762Same product: Eclipse Jetty
CVE-2025-5115Same product: Eclipse Jetty
CVE-2024-7708Same product: Eclipse Jetty
CVE-2024-8184Same product: Eclipse Jetty

Affected Assets

eclipse
jetty
12.0.0 — 12.0.35 · 12.1.0 — 12.1.9

Mitigating Controls

Control response

Prevent
Stop it (NIST 800-53)

—

Detect
Catch it (NIST detect / respond)

—

Harden
Shrink the surface (DISA STIG)

—

Validate
Prove the fix (OWASP ASVS)
  • V2.2.1
  • V10.4.1

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.AA-05 mostly match
prevents

Enforcing well-defined authorization policies prevents URL canonicalization bypasses when path handling is included in the implementation.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

A.8.29 Security testing in development and acceptance mostly match
detects

Security testing can discover non-canonical URL bypasses but does not itself implement the preventive control.

A.8.26 Application security requirements partial match
prevents

Defining application security requirements that mandate canonical URL handling and authorization checks mitigates the weakness at design time.

A.8.28 Secure coding partial match
prevents

Secure-coding standards that require URL canonicalization and safe path handling eliminate the root cause of the weakness.

A.8.3 Information access restriction partial match
prevents

Enforcing strict access-control rules on canonical resource identifiers directly prevents authorization bypass via non-canonical URLs.

References