CVE-2026-8384: Eclipse Jetty Path Traversal Vulnerability

CVE-2026-8384 Overview

CVE-2026-8384 is a path resolution vulnerability in Eclipse Jetty. When Jetty processes an HTTP URI containing a semicolon segment followed by parent directory traversal, the server returns an unresolved path to downstream web applications. For example, the URI /public;/../admin/secret.txt is passed through as /public/../admin/secret.txt rather than being normalized to /admin/secret.txt.

Jetty itself does not serve the target file because its alias checker only serves resolved resources. However, web applications that trust Jetty to provide fully resolved paths may make incorrect authorization or routing decisions. The issue is tracked under CWE-647: Use of Non-Canonical URL Paths for Authorization Decisions.

Critical Impact
Web applications relying on Jetty-normalized paths for access control may expose restricted resources when attackers craft URIs containing semicolon path parameters combined with directory traversal sequences.

Affected Products

Eclipse Jetty (see vendor advisory for affected version ranges)
Web applications deployed on Jetty that consume request paths for authorization
Downstream services and reverse proxies parsing Jetty-forwarded paths

Discovery Timeline

2026-07-14 - CVE-2026-8384 published to NVD
2026-07-14 - Last updated in NVD database

Technical Details for CVE-2026-8384

Vulnerability Analysis

The flaw resides in how Jetty processes semicolon path parameters during URI decoding. In HTTP URIs, the semicolon character introduces path parameters as defined in RFC 3986. Jetty strips these parameters during processing but does not properly normalize the resulting path when it contains parent directory references (..).

Given the request URI /public;/../admin/secret.txt, Jetty produces the unresolved path /public/../admin/secret.txt instead of the canonical form /admin/secret.txt. Jetty's alias checker prevents Jetty from serving the target file directly. The risk emerges when embedded web applications, servlets, or filters make authorization decisions based on the raw path string provided by Jetty.

Root Cause

The root cause is inconsistent URI normalization across the request processing pipeline. Semicolon segments are consumed early, but the subsequent path is not re-normalized to collapse .. sequences. Applications that expect Jetty to hand them a canonical, resolved path receive a hybrid string that appears benign at the prefix (/public/...) while actually pointing elsewhere.

Attack Vector

An unauthenticated remote attacker sends a crafted HTTP request over the network. The attacker inserts a semicolon segment followed by .. traversal sequences to bypass path-prefix-based access controls in Jetty-hosted applications. Exploitation requires no privileges or user interaction. The impact is limited to integrity of downstream authorization decisions and does not directly expose files served by Jetty's own static handler.

See the Eclipse GitLab CVE Assignment for the authoritative technical description.

Detection Methods for CVE-2026-8384

Indicators of Compromise

HTTP access log entries containing semicolon characters immediately followed by .. sequences, such as ;/.. or ;/../
Requests to URIs of the form /<prefix>;/../<restricted-path> targeting protected servlet contexts
Application logs showing authorization checks against paths that contain literal .. segments

Detection Strategies

Deploy web application firewall (WAF) rules that flag or block URIs combining semicolon path parameters with parent directory traversal sequences
Enable verbose request logging in Jetty and downstream applications to capture the raw path string as processed by each layer
Correlate anomalous 200/403 response patterns on protected endpoints with requests containing ; and .. in the URI

Monitoring Recommendations

Monitor Jetty access logs for repeated probing patterns targeting administrative or authenticated URI prefixes
Alert on downstream application errors indicating unexpected path resolution or file-not-found conditions on sensitive routes
Track cumulative counts of requests matching traversal signatures per source IP to identify scanning activity

How to Mitigate CVE-2026-8384

Immediate Actions Required

Upgrade Eclipse Jetty to the patched version identified in the Eclipse GitLab CVE Assignment
Audit deployed web applications for authorization logic that inspects raw request paths without independent normalization
Deploy WAF rules to reject requests containing ; followed by .. traversal until patching is complete

Patch Information

Refer to the Eclipse GitLab CVE Assignment for the fixed release versions and upgrade instructions. Apply vendor-supplied updates during the next maintenance window and validate that path normalization returns canonical resolved paths after upgrading.

Workarounds

Add a servlet filter or reverse proxy rule that normalizes and rejects request URIs containing .. segments after semicolon stripping
Reject any request path containing the literal substring /.. before dispatching to application handlers
Configure upstream proxies such as NGINX or Apache HTTPD to normalize URIs and forward only canonical paths to Jetty backends

bash

# NGINX example: reject traversal patterns before proxying to Jetty
location / {
    if ($request_uri ~* "(;/\.\.|/\.\./)") {
        return 400;
    }
    proxy_pass http://jetty_backend;
}