Read the docs
TI-2026-74689 Aliases CVE-2026-76182

Query parameter injection in Eclipse Jetty try-files forwarding

Priority HIGH 70CWE-74Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Deferred Red Hat: fix deferred

Attack profile from CVSS 4.0 · CNA. Fix status from CNA and Red Hat.

Summary

Eclipse Jetty 9.4.0 through 9.4.64, 10.0.0 through 10.0.32, 11.0.0 through 11.0.32, 12.0.0 through 12.0.38 and 12.1.0 through 12.1.12 are affected. TryPathsHandler and TryFilesFilter forward requests to templated URIs without escaping reserved query characters in the request path, which is CWE-74. A remote unauthenticated attacker can inject extra query parameters into the forwarded request.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Description from the CNA

In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.00345 28th percentileScored 2026-11-07
Fix Deferred Red Hat: fix deferred

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
Poc
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty12.1.0 – 12.1.12; 12.0.0 – 12.0.38—No fix listedCNA
Eclipse FoundationEclipse Jetty12.1.0 – 12.1.12—No fix listedCNA
Eclipse FoundationEclipse Jetty12.1.0 – 12.1.12; 12.0.0 – 12.0.38—No fix listedCNA
Eclipse FoundationEclipse Jetty12.1.0 – 12.1.12; 12.0.0 – 12.0.38—No fix listedCNA
Eclipse FoundationEclipse Jetty11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 9.4.0 – 9.4.64—No fix listedCNA
Eclipse FoundationEclipse Jetty12.1.0 – 12.1.12; 12.0.0 – 12.0.38—No fix listedCNA
  • Eclipse Jetty VendorEclipse Foundation Affected 12.1.0 – 12.1.12; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
  • Eclipse Jetty VendorEclipse Foundation Affected 12.1.0 – 12.1.12 Fixed in — No fix listed CNA
  • Eclipse Jetty VendorEclipse Foundation Affected 12.1.0 – 12.1.12; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
  • Eclipse Jetty VendorEclipse Foundation Affected 12.1.0 – 12.1.12; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA
  • Eclipse Jetty VendorEclipse Foundation Affected 11.0.0 – 11.0.32; 10.0.0 – 10.0.32; 9.4.0 – 9.4.64 Fixed in — No fix listed CNA
  • Eclipse Jetty VendorEclipse Foundation Affected 12.1.0 – 12.1.12; 12.0.0 – 12.0.38 Fixed in — No fix listed CNA

Remediation

The sources list no fixed version for Eclipse Jetty. Red Hat lists no fix planned for Exploit Intelligence, OpenShift Developer Tools and Services, Red Hat Fuse 7 and Red Hat Offline Knowledge Portal, and no available fix for Red Hat AMQ Broker 7, Red Hat build of Apache Camel - HawtIO 4, Red Hat build of Apache Camel for Spring Boot 4, Red Hat build of Apicurio Registry 3 and Red Hat build of Debezium 3.

Written with Claude Haiku 5.5 from the sources below · 2026-11-06

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Exploit IntelligenceAffectedNo fix planned: Out of support scope
OpenShift Developer Tools and ServicesAffectedNo fix planned: Out of support scope
Red Hat AMQ Broker 7AffectedNo fix yet: Fix deferred
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat Offline Knowledge PortalAffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel - HawtIO 4AffectedNo fix yet: Fix deferred
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet: Fix deferred
Red Hat build of Apicurio Registry 3AffectedNo fix yet: Fix deferred
Red Hat build of Debezium 3AffectedNo fix yet: Fix deferred
Not affected: 7 products
  • Red Hat Enterprise Linux 10
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat OpenShift AI (RHOAI)
  • Red Hat OpenShift Dev Spaces
  • Red Hat Satellite 6

Timeline

  1. 2026-10-16 Threatist record created from CVE-2026-76182
  2. 2026-10-16 Affected versions changed · Red Hat
  3. 2026-10-16 CVSS score added · Red Hat

References

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-81947 Unauthenticated command injection in Eclipse Che che-machine-exec CVSS 3.1CRITICAL 9.8
  • TI-2026-13216 CWE-863: ABAC authorization bypass via trailing slash route normalization in Eclipse BaSyx Go Components CVSS 3.1CRITICAL 9.8
  • TI-2026-06514 Path traversal in Eclipse BaSyx CVSS 3.1CRITICAL 10.0
  • TI-2026-01382 In the Eclipse Theia Website repository, the GitHub Actions workflow… CVSS 3.1CRITICAL 10.0
  • TI-2026-74697 Authentication bypass in Eclipse Jetty EthereumAuthenticator CVSS 4.0CRITICAL 9.3
See all 466 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences