Information disclosure in Eclipse Jetty
Priority MEDIUM 64CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 6 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Why it matters now
EPSS 0.7848 99th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-servlets (Maven): 9.4.41, 10.0.3, 11.0.3Red Hat: 6 advisoriesRed Hat: 6 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | up to 9.4.40; up to 10.0.2; up to 11.0.2 | — | No fix listed | CNA |
| — | org.eclipse.jetty:jetty-servlets (Maven) | before 9.4.41 | 9.4.41 | Patch available | GHSA-gwcr-j4wh-j3cq |
| — | org.eclipse.jetty:jetty-servlets (Maven) | 10.0.0 to before 10.0.3 | 10.0.3 | Patch available | GHSA-gwcr-j4wh-j3cq |
| — | org.eclipse.jetty:jetty-servlets (Maven) | 11.0.0 to before 11.0.3 | 11.0.3 | Patch available | GHSA-gwcr-j4wh-j3cq |
- Eclipse Jetty VendorEclipse Foundation Affected up to 9.4.40; up to 10.0.2; up to 11.0.2 Fixed in — No fix listed CNA
- org.eclipse.jetty:jetty-servlets (Maven) Vendor— Affected before 9.4.41 Fixed in 9.4.41 Patch available GHSA-gwcr-j4wh-j3cq
- org.eclipse.jetty:jetty-servlets (Maven) Vendor— Affected 10.0.0 to before 10.0.3 Fixed in 10.0.3 Patch available GHSA-gwcr-j4wh-j3cq
- org.eclipse.jetty:jetty-servlets (Maven) Vendor— Affected 11.0.0 to before 11.0.3 Fixed in 11.0.3 Patch available GHSA-gwcr-j4wh-j3cq
CPE configurations NVD · 10
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | before 9.4.41; 10.0.0 to before 10.0.3; 11.0.0 to before 11.0.3 | Vulnerable | Eclipse Foundation |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* | 1.14.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* | before 21.3 | Vulnerable | Oracle |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions before 9.4.41; 10.0.0 to before 10.0.3; 11.0.0 to before 11.0.3 Vulnerable ·Eclipse Foundation
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* Versions before 21.3 Vulnerable ·Oracle
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-gwcr-j4wh-j3cq org.eclipse.jetty:jetty-servlets (Maven) Fixed in 9.4.41 Advisory →
- Fix · GHSA-gwcr-j4wh-j3cq org.eclipse.jetty:jetty-servlets (Maven) Fixed in 10.0.3 Advisory →
- Fix · GHSA-gwcr-j4wh-j3cq org.eclipse.jetty:jetty-servlets (Maven) Fixed in 11.0.3 Advisory →
Red Hat 6 advisories
- RHSA-2022:7257 Released 2022-10-27 · Red Hat rating LowRed Hat Integration Camel-K 1.8.1 security update
- RHINT Camel-K 1.8.1
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
Show 3 more Red Hat advisories
- RHSA-2021:3758 Released 2021-10-18 · Red Hat rating ModerateOpenShift Container Platform 4.9.0 packages and security update
- Red Hat OpenShift Container Platform 4.9 coreos-installer-0.10.0-2.rhaos4.9.el8, coreos-installer-bootinfra-0.10.0-2.rhaos4.9.el8, jenkins-2.289.3.1630554997-1.el8 +10
- RHSA-2021:3700 Released 2021-09-30 · Red Hat rating ModerateRed Hat AMQ Broker 7.9.0 release and security update
- Red Hat AMQ 7.9.0
- RHSA-2021:3225 Released 2021-08-19 · Red Hat rating ModerateRed Hat AMQ Streams 1.8.0 release and security update
- Red Hat AMQ Streams 1.8.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat Integration Service Registry | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Will not fix |
| RHINT Camel-K 1.8.1 | Fixed | RHSA-2022:7257 |
| Red Hat AMQ 7.9.0 | Fixed | RHSA-2021:3700 |
| Red Hat AMQ Streams 1.8.0 | Fixed | RHSA-2021:3225 |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2021:3758 |
Not affected: 2 products
- Red Hat Enterprise Linux 8
- Red Hat OpenShift Container Platform 4.9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-28169
- 2026-10-03 Alias added: GHSA-gwcr-j4wh-j3cq
References
Patch 3
Advisory 5
Other 36
- [kafka-users] 20210617 vulnerabilities
- [kafka-jira] 20210623 [GitHub] [kafka] dongjinleekr opened a new pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.41
- [kafka-dev] 20210623 [jira] [Created] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41
- [kafka-jira] 20210623 [jira] [Created] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41
- [kafka-jira] 20210704 [GitHub] [kafka] ijuma commented on pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.42
- [kafka-jira] 20210704 [GitHub] [kafka] ijuma merged pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.42
- [kafka-dev] 20210722 [jira] [Resolved] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41
- [kafka-jira] 20210722 [jira] [Updated] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.42
- [kafka-jira] 20210722 [jira] [Resolved] (KAFKA-12985) CVE-2021-28169 - Upgrade jetty to 9.4.41
- [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42
- [zookeeper-issues] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42
- [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42
- [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42
- [zookeeper-dev] 20210928 [jira] [Created] (ZOOKEEPER-4390) CVE-2021-28169 - Upgrade jetty to 9.4.42
- [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42
- https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210727-0009
- https://lists.apache.org/thread.html/rfff6ff8ffb31e8a32619c79774def44b6ffbb037c128c5ad3eab7171@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rd5b52362f5edf98e0dcab6541a381f571cccc05ad9188e793af688f3@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rb1292d30462b9baedea7c5d9594fc75990d9aa0ec223b48054ca9c25@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r91e34ff61aff8fd25a3f2a21539597c6ef7589a31c199b0a9546477c@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r33eb06b05afbc7df28d31055cae0cb3fd36cab808c884bf6d680bea5@%3Cdev.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r32b0b640ad2be3b858f0af51c68a7d5c5a66a462c8bbb93699825cd3@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r29678972c3f8164b151fd7a5802785d402e530c09870a82ffc7681a4@%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r284de9c5399486dfff12ab9e7323ca720dd7019a9a3e11c8510a7140@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r2721aba31a8562639c4b937150897e24f78f747cdbda8641c0f659fe@%3Cusers.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r234f6452297065636356f43654cdacef565b8f9ceb0e0c07ffb8c73b@%3Cdev.kafka.apache.org%3E
- https://lists.apache.org/thread.html/r04a4b4553a23aff26f42635a6ae388c3b162aab30a88d12e59d05168@%3Cjira.kafka.apache.org%3E
- https://github.com/eclipse/jetty.project
More Eclipse Foundation Jetty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
- TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
- TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
- TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
- TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-28169 · CVE Program
- CVE-2021-28169 · NVD
- FIRST EPSS
- GHSA-gwcr-j4wh-j3cq · GitHub Advisory Database · CC BY 4.0
- CVE-2021-28169 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences