CVE-2026-18660

The exception handling code in Eclipse Jetty before version 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, known as JetLeak.

In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode passwords as bytes, silently replacing characters outside that charset with '?'.

In Eclipse Jetty, SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext. An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.

In Eclipse Jetty, across various versions of jetty-security and jetty-eeN-security, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec. Resulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.

In Eclipse Jetty, across various versions of jetty-security, jetty-eeN-security, and jetty-eeN-servlet, the Jakarta Spec constraints defined as http-method-omission can be bypassed by using substrings of the defined HTTP Methods.

In Jetty's HttpClient, when a request is made through a forward proxy, the server may reply with a 407 (Proxy Authentication Required). The client mistakenly interprets the 407 as coming from the proxy and re-sends the request with the Proxy-Authentication header, which reaches the server and exposes the proxy credentials to it.

In Eclipse Jetty, HttpClient may receive a redirect of the form /secure/../evil. If an attacker controls the redirects, HttpClient matches authentication credentials against /secure rather than normalizing the path to /evil, and therefore follows the redirect sending the Authorization header for /secure to /evil.

In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.

In Eclipse Jetty, across various versions of jetty-annotations and jetty-eeN-annotations, the Jakarta Spec authoritative url-pattern rules for mixed @ServletSecurity annotation and web.xml defined security-constraint on the same url-pattern were not applied if the web.xml had more than one url-pattern for a servlet and a security-constraint applied to only some of those url-pattern definitions.

In Eclipse Jetty, a vulnerability has been identified involving incorrect path resolution for URIs containing semicolons. A request to a resource like '/public;/../admin/secret.txt' results in Jetty returning an unresolved path '/public/../admin/secret.txt' instead of the expected '/admin/secret.txt'. Jetty itself is not vulnerable because it does not serve files that fail the alias check, but web applications relying on Jetty's path resolution may be confused.