CLSA-2026-1793790043: TuxCare security update for org.eclipse.jetty (2 CVEs)
Published Nov 4, 2026
·Updated
TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.50.v20221201-tuxcare.6.
Affected Software
2 affected componentsFixes available
tuxcare/org.eclipse.jetty:jetty-jaspi>=9.4.50.v20221201<9.4.50.v20221201-tuxcare.6
9.4.50.v20221201-tuxcare.6
tuxcare/org.eclipse.jetty:jetty-server>=9.4.50.v20221201<9.4.50.v20221201-tuxcare.6
9.4.50.v20221201-tuxcare.6
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
tuxcare/org.eclipse.jetty:jetty-jaspito a version that resolves this vulnerability.Fixed in 9.4.50.v20221201-tuxcare.6 - Upgrade
Upgrade
tuxcare/org.eclipse.jetty:jetty-serverto a version that resolves this vulnerability.Fixed in 9.4.50.v20221201-tuxcare.6 - Upgrade
Upgrade
org.eclipse.jettyto a version that resolves this vulnerability.Fixed in 9.4.50.v20221201-tuxcare.6
Event History
Nov 4, 2026
Advisory Published
via OSV·12:00 PM
Data Sourced
via OSV·12:00 PM
DescriptionAffected Software
Frequently Asked Questions
1
Which Jetty packages are included in this update?
The update covers the jetty-jaspi and jetty-server packages from TuxCare's org.eclipse.jetty software set.
2
What package version contains the fixes?
The fixes are included in version 9.4.50.v20221201-tuxcare.6.