CVE-2021-28164
Authorization Before Parsing and Canonicalization in jetty
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- Low
- Integrity
- None
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
- Record
CVE-2021-28164- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-551
- Updated
- 2026-11-02
EUVDEUVD-2021-0877
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
- Record
EUVD-2021-0877- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-v7ff-8wcx-gmc5
Authorization Before Parsing and Canonicalization in jetty
Release 9.4.37 introduced a more precise implementation of RFC3986 with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Workarounds found by HttpCompliance mode RFC7230_NO_AMBIGUOUS_URIS can be enabled by updating start.d/http.ini to include: jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS.
- Record
GHSA-v7ff-8wcx-gmc5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-551, CWE-863
- Updated
- 2026-11-02
NVD
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
- Record
CVE-2021-28164- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:P/I:N/A:N - Weakness
- CWE-200, CWE-551
- Updated
- 2026-11-02
OSV
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
- Record
CVE-2021-28164- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVDEBIAN-CVE-2021-28164
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
- Record
DEBIAN-CVE-2021-28164- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
Show 6 moreShow less
OSVGHSA-v7ff-8wcx-gmc5
Authorization Before Parsing and Canonicalization in jetty
Release 9.4.37 introduced a more precise implementation of RFC3986 with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application. Workarounds found by HttpCompliance mode RFC7230_NO_AMBIGUOUS_URIS can be enabled by updating start.d/http.ini to include: jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS.
- Record
GHSA-v7ff-8wcx-gmc5- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Weakness
- CWE-200, CWE-551, CWE-863
- Updated
- 2026-11-02
OSVRHSA-2021:1509
Red Hat Security Advisory: rh-eclipse-jetty security update
- Record
RHSA-2021:1509- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2021-28164
In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. For example a request to /context/%2e/WEB-INF/web.xml can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.
- Record
UBUNTU-CVE-2021-28164- CVSS 3.1
- 5.3 Medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2021:2005-1 No score
Security update for jetty-minimal
This update for jetty-minimal fixes the following issues:
Update to version 9.4.42.v20210604
- Fix: bsc#1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory
- Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when client send data length > 17408
- Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs
- Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory from deployment scan
- Record
openSUSE-SU-2021:2005-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:10878-1 No score
jetty-annotations-9.4.43-1.2 on GA media
These are all security issues fixed in the jetty-annotations-9.4.43-1.2 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:10878-1- Updated
- 2026-11-02
OSVSUSE-SU-2021:2005-1 No score
Security update for jetty-minimal
This update for jetty-minimal fixes the following issues:
Update to version 9.4.42.v20210604
- Fix: bsc#1187117, CVE-2021-28169 - possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory
- Fix: bsc#1184367, CVE-2021-28165 - jetty server high CPU when client send data length > 17408
- Fix: bsc#1184368, CVE-2021-28164 - Normalize ambiguous URIs
- Fix: bsc#1184366, CVE-2021-28163 - Exclude webapps directory from deployment scan
- Record
SUSE-SU-2021:2005-1- Updated
- 2026-11-02
Affected products
- eclipse jetty
- eclipse foundation jetty
- the eclipse foundation eclipse jetty
- netapp cloud manager
- netapp e-series performance analyzer
- netapp e-series santricity os controller
- netapp e-series santricity web services
- netapp element plug-in for vcenter server
- netapp santricity cloud connector
- netapp snapcenter
- netapp snapcenter plug-in
- netapp storage replication adapter for clustered data ontap
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty:jetty-webappMaven |
9.4.37 up to 9.4.39 | 9.4.39 |
jetty9Debian:12 |
before 9.4.39-1 | 9.4.39-1 |
jetty9Debian:13 |
before 9.4.39-1 | 9.4.39-1 |
jetty9Debian:14 |
before 9.4.39-1 | 9.4.39-1 |
org.eclipse.jetty:jetty-webappMaven |
9.4.37 up to 9.4.39, plus listed versions 9.4.37.v202102199.4.38.v20210224 |
9.4.39 |
rh-eclipse-jettyRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-clientRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-continuationRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-httpRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-ioRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
Show 17 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rh-eclipse-jetty-jaasRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-javadocRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-jmxRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-securityRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-serverRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-servletRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-utilRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-util-ajaxRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-webappRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
rh-eclipse-jetty-xmlRed Hat:devtools:2021 From an advisory covering 3 CVEs |
before 0:9.4.40-1.1.el7_9 | 0:9.4.40-1.1.el7_9 |
jetty-minimalSUSE:Linux Enterprise Module for Development Tools 15 SP2 From an advisory covering 4 CVEs |
before 9.4.42-3.9.1 | 9.4.42-3.9.1 |
jetty-minimalSUSE:Linux Enterprise Module for Development Tools 15 SP3 From an advisory covering 4 CVEs |
before 9.4.42-3.9.1 | 9.4.42-3.9.1 |
equinox-bundlesUbuntu:18.04:LTS |
All versions, plus listed versions 4.9-2~18.04 |
None known |
equinox-bundlesUbuntu:20.04:LTS |
All versions, plus listed versions 4.12-14.13-1 |
None known |
equinox-bundlesUbuntu:22.04:LTS |
All versions, plus listed versions 4.18-14.19-1 |
None known |
jetty-minimalopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 9.4.42-3.9.1 | 9.4.42-3.9.1 |
jetty-websocketopenSUSE:Leap 15.3 From an advisory covering 4 CVEs |
before 9.4.42-3.9.1 | 9.4.42-3.9.1 |
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Jetty 9.4.37.v20210219 - Information Disclosure | 2021-10-22 |
| PoC in GitHub | jammy0903/-jettyCVE-2021-28164- | 2023-10-31 |
| PoC in GitHub | CyberCTF/vulhub-jetty-cve-2021-28164 | 2026-10-08 |
| Metasploit | Jetty WEB-INF File Disclosure | 2021-07-15 |
| Nuclei | Eclipse Jetty - Information Disclosure |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, exploits, facts | ||
| aliases, products | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, Nuclei, NVD, OSV, PoC in GitHub |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2021-28164 is a medium vulnerability (CVSS 5.3) in Eclipse Jetty, published April 1, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 82.4%, the 99th percentile. Fixed in org.eclipse.jetty:jetty-webapp 9.4.39.
References
github.com/eclipse/jetty.project/security/advisories/GHSA-v7ff-8wcx-gmc5
lists.apache.org/thread.html/r780c3c210a05c5bf7b4671303f46afc3fe56758e92864e1a5f0590d0%40%3Cjira.kafka.apache.org%3E
Show 73 moreShow less
security.netapp.com/advisory/ntap-20210611-0006
oracle.com/security-alerts/cpuoct2021.html
packetstormsecurity.com/files/164590/Jetty-9.4.37.v20210219-Information-Disclosure.html
nvd.nist.gov/vuln/detail/CVE-2021-28164
security-tracker.debian.org/tracker/CVE-2021-28164
access.redhat.com/errata/RHSA-2021:1509
bugzilla.redhat.com/show_bug.cgi?id=1945710
security.access.redhat.com/data/csaf/v2/advisories/2021/rhsa-2021_1509.json
cve.org/CVERecord?id=CVE-2021-28163
suse.com/support/update/announcement/2021/suse-su-20212005-1
bugzilla.suse.com/1184366
ubuntu.com/security/CVE-2021-28164
lists.opensuse.org/archives/list/[email protected]/thread/U4KKN3NUA6VAZ6XTFLI3KB3IHAPVD46L