Read the docs
TI-2016-04146 Aliases CVE-2016-4800GHSA-872g-2h8h-362q

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before…

Priority MEDIUM 51CWE-284Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Security bypass
Confidentiality · integrity · availability
High · High · High
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-284.

Summary

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.

Why it matters now

EPSS 0.06538 93rd percentileScored 2026-11-07
Fix Fixed org.eclipse.jetty:jetty-server (Maven): 9.3.9

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)9.3.0 to before 9.3.99.3.9Patch availableGHSA-872g-2h8h-362q
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.3.0 to before 9.3.9 Fixed in 9.3.9 Patch available GHSA-872g-2h8h-362q

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:9.3.0:*:*:*:*:*:*:*9.3.0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:*9.3.0 m0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:*9.3.0 m1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*9.3.0 maintenance2VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*9.3.0 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*9.3.0 rc1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.1:*:*:*:*:*:*:*9.3.1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.2:*:*:*:*:*:*:*9.3.2VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.3:*:*:*:*:*:*:*9.3.3VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.4:*:*:*:*:*:*:*9.3.4VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:*:*:*:*:*:*:* Versions 9.3.0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:* Versions 9.3.0 m0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:* Versions 9.3.0 m1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:* Versions 9.3.0 maintenance2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:* Versions 9.3.0 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:* Versions 9.3.0 rc1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.1:*:*:*:*:*:*:* Versions 9.3.1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.2:*:*:*:*:*:*:* Versions 9.3.2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.3:*:*:*:*:*:*:* Versions 9.3.3 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.4:*:*:*:*:*:*:* Versions 9.3.4 Vulnerable ·Eclipse Foundation
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:*9.3.4 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:*9.3.4 rc1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.5:*:*:*:*:*:*:*9.3.5VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.6:*:*:*:*:*:*:*9.3.6VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.7:*:*:*:*:*:*:*9.3.7VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:*9.3.7 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:*9.3.7 rc1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.8:*:*:*:*:*:*:*9.3.8VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:*9.3.8 rc0VulnerableEclipse Foundation
cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:*all versionsRunning onMicrosoft
  • cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:* Versions 9.3.4 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:* Versions 9.3.4 rc1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.5:*:*:*:*:*:*:* Versions 9.3.5 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.6:*:*:*:*:*:*:* Versions 9.3.6 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.7:*:*:*:*:*:*:* Versions 9.3.7 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:* Versions 9.3.7 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:* Versions 9.3.7 rc1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.8:*:*:*:*:*:*:* Versions 9.3.8 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:* Versions 9.3.8 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:o:microsoft:windows:*:*:*:*:*:*:*:* Versions all versions Running on ·Microsoft

Remediation

  • Fix · GHSA-872g-2h8h-362q org.eclipse.jetty:jetty-server (Maven) Fixed in 9.3.9 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

Not affected: 13 products
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat JBoss A-MQ 6
  • Red Hat JBoss BRMS 5
  • Red Hat JBoss Data Virtualization 6
  • Red Hat JBoss Enterprise Application Platform 5
  • Red Hat JBoss Fuse 6
  • Red Hat JBoss Fuse Service Works 6
  • Red Hat JBoss Portal 6
  • Red Hat JBoss SOA Platform 5
  • Red Hat OpenShift Enterprise 2
  • Red Hat Satellite 6
  • Red Hat Software Collections

Timeline

  1. 2026-10-02 Threatist record created from CVE-2016-4800
  2. 2026-10-03 Alias added: GHSA-872g-2h8h-362q

References

Patch 2

Advisory 3

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences