CVE-2016-4800

Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

9.8 CriticalFix available

The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: High
Availability: High

Exploit likelihood

6.36%Up 5.0 points since Feb 4, 2022

What each source reports

NVD Score used 9.8

Record: CVE-2016-4800
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0: 7.5 HighAV:N/AC:L/Au:N/C:P/I:P/A:P
Weakness: CWE-284
Updated: 2026-11-02

CVE List No score

Record: CVE-2016-4800
Updated: 2026-11-02

EUVDEUVD-2018-0545 No score

Record: EUVD-2018-0545
Updated: 2026-11-03

GitHub AdvisoriesGHSA-872g-2h8h-362q 9.8

Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

Record: GHSA-872g-2h8h-362q
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

OSV 9.8

Record: CVE-2016-4800
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Updated: 2026-11-02

OSVGHSA-872g-2h8h-362q 9.8

Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

Record: GHSA-872g-2h8h-362q
CVSS 3.0: 9.8 CriticalCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Weakness: CWE-284
Updated: 2026-11-02

Affected products

eclipse jetty

Affected packages

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty:jetty-server` Maven	9.3.0 up to 9.3.9	9.3.9
`org.eclipse.jetty:jetty-server` Maven	9.3.0 up to 9.3.9, plus listed versions 9.3.0.v201506129.3.1.v201507149.3.2.v201507309.3.3.v201508279.3.4.RC0 Show 11 moreShow less 9.3.4.RC19.3.4.v201510079.3.5.v201510129.3.6.v201511069.3.7.RC09.3.7.RC19.3.7.v201601159.3.8.RC09.3.8.v201603149.3.9.M09.3.9.M1	9.3.9

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2016-4800 is a critical vulnerability (CVSS 9.8) in Eclipse Jetty, published April 13, 2017. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 6.36%, the 93rd percentile. Fixed in org.eclipse.jetty:jetty-server 9.3.9.