CVE-2026-76182

A flaw was found in Eclipse Jetty. When configured to forward requests to template Uniform Resource Identifiers (URIs) using TryPathsHandler or TryFilesFilter, path values are not properly encoded before substitution into query strings. A remote attacker can exploit this flaw by sending requests containing reserved URI characters, resulting in query parameter injection that may alter application behavior and compromise data integrity.

A flaw was found in org.eclipse.jetty/jetty-server, org.eclipse.jetty.ee10/jetty-ee10-servlets, org.eclipse.jetty.ee9/jetty-ee9-servlets, org.eclipse.jetty.ee8/jetty-ee8-servlets. In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context.

However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the template becomes index?p=/s&a=1, which is interpreted as 2 query parameters: p=/s and a=1, rather than just one query parameter p whose value is /s&a=1. Prerequisites: Standard deployment configuration CVSS 5.3 (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N). None -- NVD score appropriate Exploitation scenario: No exploitation steps identified. Exploitation difficulty: MEDIUM. This issue affects amq-7, exploit-intelligence, fedora-all, fuse-7, ocp-tools-4, offline-knowledge-portal-1, openshift-ai, openshift-hosted-osd4, rhboac-hawtio-4, rhel-10, rhel-7, rhel-8, rhel-9, rhel-br-10, rhel-br-8, rhel-br-9, rhint-camel-spring-boot-4, rhint-debezium-3, rhint-serv-3, rhivos-2, rhivos-core-2, rhn_satellite_6, rhos_devspaces-3, services-management-platform, services-remediations-platform. Red Hat has rated this as having moderate impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat recommends updating org.eclipse.jetty/jetty-server, org.eclipse.jetty.ee10/jetty-ee10-servlets, org.eclipse.jetty.ee9/jetty-ee9-servlets, org.eclipse.jetty.ee8/jetty-ee8-servlets to the latest version when a fix is available.