5.3

CVE-2026-8384: eclipse foundation eclipse jetty

CVSS: 5.3v3.1MediumAnalyzed
AliasesUBUNTU-CVE-2026-8384DEBIAN-CVE-2026-8384CGA-23xf-34hf-6c5g
Published 14-07-2026Last modified 14-07-2026
Open JSON

Vulnerability summary

CVE-2026-8384 is a medium (CVSS 5.3) vulnerability in eclipse foundation eclipse jetty. EPSS estimates a 0.33% chance of exploitation in the next 30 days, higher than 24.6% of scored vulnerabilities. 1 public exploit is recorded.

Overall risk
31/100
0100
Medium · default modelHow is this calculated?
CVSS score
5.3/10
010
Medium · v3.1 (CVE.org)
EPSS score
0.33%
0%100%
Low · 0.00 pp in 30 days
KEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits1reference

Advisory lineage

Upstream 0 · Downstream 0 · Related 1
CGA-PX92-H7CC-M6RX

Timeline

  1. 14-07-2026
    PublishedVulnerability first disclosed.
  2. 14-07-2026
    Last modifiedVulnerability information updated.

Description

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

CVSS metrics

7 scores · 7 sources · 1 version

EPSS trend

Probability

0.33%

Chance of exploitation in the next 30 days

Percentile

25%

Versus all other CVEs

30-day change

0.00 pp

From 0.33% on 19-09-2026

19-09-202619-10-2026
EPSS score
0.33%

Known exploited

Compare KEV catalogs

Not in any of the 3 tracked catalogs.

Public exploits

1 found
  • referenceUnverified

    Exploit Reference (gitlab.eclipse.org)

    Maturity: unknown

Weaknesses

CWE · root cause

Affected systems

Chainguard66 products
  • akhq< 0.27.1-r15
  • apache-hop< 2.18.1-r16
  • apache-hop-fips< 2.18.1-r8
  • apache-jena-fuseki< 6.2.0-r1
  • confluent-kafka< 8.4.0.397-r0
Wolfi30 products
  • akhq< 0.27.1-r15
  • confluent-kafka< 8.4.0.397-r0
  • dependency-track< 4.14.3-r0
  • dependency-track-bundled< 4.14.3-r0
  • druid< 37.0.0-r47 | < 37.0.0-r56
Debian2 products
  • jetty12All versions (No fix recorded)
  • jetty9All versions (No fix recorded)
Ubuntu2 products
  • jetty12All versions (No fix recorded)
  • jetty9All versions (No fix recorded)
Eclipse1 product
  • jetty≥ 12.0.0, < 12.0.35 | ≥ 12.1.0, < 12.1.9
Eclipse foundation1 product
Org.eclipse.jetty1 product
  • jetty-util≥ 12.0.0, < 12.0.35 | ≥ 12.1.0, < 12.1.9

7 vendors · 103 products

References

14 links
Show all 14 references