CVE-2026-76182: Eclipse Jetty vulnerability
In Eclipse Jetty, TryPathsHandler and TryFilesFilter can be configured to forward requests to template URIs such as index?p=$path, where $path is the request path in context.
However, URI paths may contain characters that are reserved in URI queries so that a path of /s&a=1 when applied to the template becomes index?p=/s&a=1, which is interpreted as 2 query parameters: p=/s and a=1, rather than just one query parameter p whose value is /s&a=1.
Affected Software
Event History
Frequently Asked Questions
Which deployments are exposed?
Deployments are exposed when TryPathsHandler or TryFilesFilter is configured to forward requests to a template URI that inserts $path into a query string, such as index?p=$path.
What does an attacker need to trigger the issue?
The attacker needs to send a request whose path contains characters reserved in URI queries. When that path is substituted into the configured template, reserved characters such as & can cause additional query parameters to be interpreted.
How can I identify potentially affected configurations?
Review TryPathsHandler and TryFilesFilter forwarding templates for uses of $path within a query URI. A template such as index?p=$path is potentially affected because a request path like /s&a=1 can become separate p and a query parameters.