DEBIAN-CVE-2026-8384

See a problem?
Please try reporting it to the source first.
Source
https://security-tracker.debian.org/tracker/CVE-2026-8384
Import Source
https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8384.json
JSON Data
https://api.test.osv.dev/v1/vulns/DEBIAN-CVE-2026-8384
Upstream
Published
2026-07-14T09:16:42Z
Modified
2026-09-01T16:07:06Z
Severity
  • 5.3 (Medium) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N CVSS Calculator
Summary
[none]
Details

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

References

Affected packages

Debian:13 / jetty12

Package

Name
jetty12
Purl
pkg:deb/debian/jetty12?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

12.*
12.0.17-3
12.0.17-3.1~deb13u1
12.0.17-3.1
12.0.32-1
12.0.32-2
12.0.33-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8384.json"

Debian:14 / jetty12

Package

Name
jetty12
Purl
pkg:deb/debian/jetty12?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

12.*
12.0.17-3
12.0.17-3.1~deb13u1
12.0.17-3.1
12.0.32-1
12.0.32-2
12.0.33-1

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8384.json"

Debian:12 / jetty9

Package

Name
jetty9
Purl
pkg:deb/debian/jetty9?arch=source&distro=bookworm

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.50-4
9.4.50-4+deb12u1
9.4.50-4+deb12u2
9.4.50-4+deb12u3
9.4.51-1
9.4.51-2
9.4.52-1
9.4.53-1
9.4.54-1
9.4.55-1
9.4.56-1
9.4.57-0+deb12u1
9.4.57-1
9.4.57-1.1~deb12u1
9.4.57-1.1~deb13u1
9.4.57-1.1
9.4.58-1
9.4.58-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8384.json"

Debian:13 / jetty9

Package

Name
jetty9
Purl
pkg:deb/debian/jetty9?arch=source&distro=trixie

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.57-1
9.4.57-1.1~deb12u1
9.4.57-1.1~deb13u1
9.4.57-1.1
9.4.58-1
9.4.58-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8384.json"

Debian:14 / jetty9

Package

Name
jetty9
Purl
pkg:deb/debian/jetty9?arch=source&distro=forky

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0 Unknown introduced version / All previous versions are affected

Affected versions

9.*
9.4.57-1
9.4.57-1.1~deb12u1
9.4.57-1.1~deb13u1
9.4.57-1.1
9.4.58-1
9.4.58-2

Ecosystem specific 

{
    "urgency": "not yet assigned"
}

Database specific

source 
"https://storage.googleapis.com/osv-test-debian-osv/debian-cve-osv/DEBIAN-CVE-2026-8384.json"