CVE-2026-8384

A flaw was found in Eclipse Jetty. An attacker could craft a specially formed HTTP Uniform Resource Identifier (URI) that, when processed by Jetty, results in an unresolved path. While Jetty itself is not directly affected, web applications relying on Jetty to provide resolved paths may be confused, potentially leading to unintended information disclosure. This could allow an attacker to access sensitive files or directories that should otherwise be protected.

Moderate impact: This path confusion vulnerability in Eclipse Jetty affects web applications that rely on Jetty to provide resolved paths. While Jetty itself correctly handles these paths and prevents direct file serving, vulnerable web applications may misinterpret unresolved paths, potentially leading to information disclosure.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.