CVE-2026-8384: 
Jetty vulnerability analysis and mitigation

CVE-2026-8384 is a path traversal / non-canonical URL authorization bypass vulnerability in Eclipse Jetty. When an HTTP URI contains a semicolon-delimited path segment such as /public;/../admin/secret.txt, Jetty passes the unresolved path /public/../admin/secret.txt to the web application instead of the canonicalized /admin/secret.txt. Affected versions are Eclipse Jetty 12.0.0–12.0.34 and 12.1.0–12.1.8; fixed versions are 12.0.35 and 12.1.9. It carries a CVSS v3.1 base score of 5.3 (Medium) (Eclipse CVE Assignment).

The root cause is classified as CWE-647 (Use of Non-Canonical URL Paths for Authorization Decisions): Jetty does not fully resolve path segments that contain semicolons before forwarding the request path to the web application. An attacker crafts an HTTP URI where a semicolon is inserted into a path component (e.g., /public;/../admin/secret.txt), causing the path traversal sequence /../ to survive unresolved into the application layer. Jetty's own alias checker prevents it from serving restricted files directly, so the server itself is not vulnerable; however, web applications that perform access-control decisions based on the raw path string received from Jetty can be deceived into granting access to protected resources. A concrete, reproducible proof-of-concept URI is documented in the official CVE record (Eclipse CVE Assignment).

The primary impact is an integrity-level authorization bypass (CVSS integrity impact: Low): an unauthenticated remote attacker may circumvent application-level path-based access controls, potentially accessing or manipulating resources that should be restricted. Confidentiality is not directly impacted at the Jetty layer because Jetty's alias checker blocks file serving, but downstream web applications that trust the unresolved path for routing or authorization decisions may inadvertently expose protected endpoints or data. Availability is not affected (Eclipse CVE Assignment).

1. Reconnaissance: Identify web applications running on Eclipse Jetty 12.0.0–12.0.34 or 12.1.0–12.1.8 that perform path-based authorization checks using the request URI provided by Jetty (e.g., via HTTP response headers, error pages, or service fingerprinting).
2. Craft malicious URI: Construct an HTTP request URI that embeds a semicolon within a permitted path segment followed by a path traversal sequence, for example: GET /public;/../admin/secret.txt HTTP/1.1.
3. Send request: Transmit the crafted request to the target server. Jetty will parse the URI and forward the unresolved path /public/../admin/secret.txt to the web application rather than the canonicalized /admin/secret.txt.
4. Bypass authorization: If the web application's access-control logic checks whether the path starts with /public (or another permitted prefix) without normalizing it first, the unresolved path may pass the check, granting access to the protected resource.
5. Access protected resource: The web application serves or processes the resource at the traversed path (e.g., /admin/secret.txt), completing the authorization bypass (Eclipse CVE Assignment).

• Network: HTTP requests containing semicolons within path segments combined with /../ traversal sequences (e.g., GET /public;/../admin/ or similar patterns) in web server access logs.
• Logs: Access log entries where the raw request URI contains ;/.. sequences but the application log records access to a different (protected) resource path; unexpected HTTP 200 responses to requests targeting nominally restricted paths.
• Application Behavior: Authorization decisions granting access to protected resources (e.g., /admin/) originating from requests whose URI begins with a permitted prefix (e.g., /public) — detectable via application-level audit logging if path normalization is logged (Eclipse CVE Assignment).

Upgrade Eclipse Jetty to version 12.0.35 (for the 12.0.x branch) or 12.1.9 (for the 12.1.x branch) to receive the official fix. As a defense-in-depth measure, web applications should implement independent path normalization and canonicalization before performing any authorization decisions, rather than relying solely on the path string provided by the application server. Deploying a WAF rule to reject or normalize HTTP URIs containing semicolons in path segments can also reduce exposure while patching is underway (Eclipse CVE Assignment).