CVE-2026-76184

A flaw was found in Eclipse Jetty's HttpClient. When handling HTTP redirects containing path traversal sequences, the client fails to normalize the destination path before matching stored authentication credentials. A remote attacker who controls redirect responses can exploit this issue to cause the client to transmit sensitive authorization headers to an unintended endpoint on the same domain, leading to information disclosure.

A flaw was found in org.eclipse.jetty/jetty-client, org.eclipse.jetty/jetty-http-tools. In Eclipse Jetty, HttpClient may receive a redirect of the form:

/secure/../evil

If an attacker is able to control the redirects, then HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and will therefore follow the redirect sending the Authorization header for /secure to /evil.

This also mean that the attacker must have an evil application deployed on the same domain as the target. Prerequisites: Standard deployment configuration CVSS 5.9 (CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N). None -- NVD score appropriate Exploitation scenario: No exploitation steps identified. Exploitation difficulty: MEDIUM. This issue affects fedora-all, fuse-7, offline-knowledge-portal-1, openshift-ai, openshift-hosted-osd4, rhboac-camel-quarkus-3, rhboac-hawtio-4, rhel-7, rhel-9, rhint-camel-spring-boot-4, rhint-debezium-3, rhint-serv-3, rhn_satellite_6, rhos_devspaces-3, services-management-platform, services-remediations-platform. Red Hat has rated this as having moderate impact.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Red Hat recommends updating org.eclipse.jetty/jetty-client, org.eclipse.jetty/jetty-http-tools to the latest version when a fix is available.