CVE-2026-5795
Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- High
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- High
- Integrity
- High
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
- Record
CVE-2026-5795- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-226, CWE-287, CWE-226
- Updated
- 2026-11-02
EUVDEUVD-2026-20473
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
- Record
EUVD-2026-20473- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-gc59-r5jq-98qw
Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-r7p8-xq5m-436c. This link is maintained to preserve external references.
Original Description
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
- Record
GHSA-gc59-r5jq-98qw- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-226
- Updated
- 2026-11-02
GitHub AdvisoriesGHSA-r7p8-xq5m-436c
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Description (as reported)
A security vulnerability has been identified in Jetty's JaspiAuthenticator.java.
The root cause is a failure to consistently clear authentication metadata stored in ThreadLocal during certain error or incomplete authentication flows.
Specifically, after a GroupPrincipalCallback is persisted into the ThreadLocal, the authentication process may exit prematurely — before the ThreadLocal storage is cleared — if a mandatory CallerPrincipalCallback is missing or an exception occurs.
This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.
See also attached PDF.
Impact
An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).
Patches
No patches yet.
Workarounds
Do not use Jetty's JASPI.
- Record
GHSA-r7p8-xq5m-436c- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-226, CWE-287
- Updated
- 2026-11-02
NVD
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
- Record
CVE-2026-5795- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-226, CWE-287
- Updated
- 2026-11-02
OSV
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
- Record
CVE-2026-5795- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-226, CWE-287
- Updated
- 2026-11-02
Show 25 moreShow less
OSVDEBIAN-CVE-2026-5795
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
- Record
DEBIAN-CVE-2026-5795- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-04
OSVGHSA-gc59-r5jq-98qw
Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Duplicate Advisory
This advisory has been withdrawn because it is a duplicate of GHSA-r7p8-xq5m-436c. This link is maintained to preserve external references.
Original Description
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.
Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.
A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
- Record
GHSA-gc59-r5jq-98qw- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-226
- Updated
- 2026-11-02
OSVGHSA-r7p8-xq5m-436c
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Description (as reported)
A security vulnerability has been identified in Jetty's JaspiAuthenticator.java.
The root cause is a failure to consistently clear authentication metadata stored in ThreadLocal during certain error or incomplete authentication flows.
Specifically, after a GroupPrincipalCallback is persisted into the ThreadLocal, the authentication process may exit prematurely — before the ThreadLocal storage is cleared — if a mandatory CallerPrincipalCallback is missing or an exception occurs.
This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.
See also attached PDF.
Impact
An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).
Patches
No patches yet.
Workarounds
Do not use Jetty's JASPI.
- Record
GHSA-r7p8-xq5m-436c- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Weakness
- CWE-226, CWE-287
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2026-5795
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
- Record
UBUNTU-CVE-2026-5795- CVSS 3.1
- 7.4 High
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N - Updated
- 2026-11-02
OSVCLSA-2026-1775781156 No score
TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)
TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 11.0.29.tuxcare0001.
- Record
CLSA-2026-1775781156- Updated
- 2026-11-02
OSVCLSA-2026-1775781157 No score
TuxCare security update for 2 packages (2 CVEs)
TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.61.tuxcare0001.
- Record
CLSA-2026-1775781157- Updated
- 2026-11-02
OSVCLSA-2026-1775781158 No score
TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)
TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 10.0.29.tuxcare0001.
- Record
CLSA-2026-1775781158- Updated
- 2026-11-02
OSVCLSA-2026-1777336763 No score
TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)
TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 11.0.28-tuxcare.2.
- Record
CLSA-2026-1777336763- Updated
- 2026-11-02
OSVCLSA-2026-1778201085 No score
TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)
TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 11.0.27.tuxcare0002.
- Record
CLSA-2026-1778201085- Updated
- 2026-11-02
OSVCLSA-2026-1779238058 No score
TuxCare security update for org.eclipse.jetty (2 CVEs)
TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 11.0.26-tuxcare.1.
- Record
CLSA-2026-1779238058- Updated
- 2026-11-02
OSVCLSA-2026-1779324478 No score
TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)
TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 9.4.58.v20250814-tuxcare.1.
- Record
CLSA-2026-1779324478- Updated
- 2026-11-02
OSVCLSA-2026-1779324480 No score
TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)
TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 10.0.26-tuxcare.1.
- Record
CLSA-2026-1779324480- Updated
- 2026-11-02
OSVCLSA-2026-1786356731 No score
TuxCare security update for org.eclipse.jetty (2 CVEs)
TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 10.0.27.tuxcare0004.
- Record
CLSA-2026-1786356731- Updated
- 2026-11-02
OSVCLSA-2026-1786358468 No score
TuxCare security update for org.eclipse.jetty (2 CVEs)
TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 10.0.28.tuxcare0003.
- Record
CLSA-2026-1786358468- Updated
- 2026-11-02
OSVCLSA-2026-1786437309 No score
TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)
TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 9.4.59.tuxcare0003.
- Record
CLSA-2026-1786437309- Updated
- 2026-11-02
OSVCLSA-2026-1786550111 No score
TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)
TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 9.4.57.v20241219-tuxcare.5.
- Record
CLSA-2026-1786550111- Updated
- 2026-11-02
OSVCLSA-2026-1792753531 No score
TuxCare security update for 3 packages (4 CVEs)
TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 11.0.18-tuxcare.1.
- Record
CLSA-2026-1792753531- Updated
- 2026-11-02
OSVCLSA-2026-1792756836 No score
TuxCare security update for 3 packages (4 CVEs)
TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 11.0.19-tuxcare.4.
- Record
CLSA-2026-1792756836- Updated
- 2026-11-02
OSVCLSA-2026-1792769441 No score
TuxCare security update for org.eclipse.jetty (2 CVEs)
TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.2.16.v20160414-tuxcare.2.
- Record
CLSA-2026-1792769441- Updated
- 2026-11-02
OSVCLSA-2026-1793132217 No score
TuxCare security update for 9 packages (5 CVEs)
TuxCare rebuilt 9 packages to address 5 CVEs. Fixed in 12.0.22-tuxcare.1.
- Record
CLSA-2026-1793132217- Updated
- 2026-11-02
OSVCLSA-2026-1793790043 No score
TuxCare security update for org.eclipse.jetty (2 CVEs)
TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.50.v20221201-tuxcare.6.
- Record
CLSA-2026-1793790043- Updated
- 2026-11-04
OSVCLSA-2026-1793798237 No score
TuxCare security update for org.eclipse.jetty (2 CVEs)
TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.53.v20231009-tuxcare.9.
- Record
CLSA-2026-1793798237- Updated
- 2026-11-04
OSVopenSUSE-SU-2026:10574-1 No score
jetty-annotations-9.4.58-4.1 on GA media
These are all security issues fixed in the jetty-annotations-9.4.58-4.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2026:10574-1- Updated
- 2026-11-02
OSVROOT-APP-MAVEN-CVE-2026-5795 No score
CVE-2026-5795 in org.eclipse.jetty.ee10:jetty-ee10-jaspi - Patched by Root
Root has patched CVE-2026-5795 in the org.eclipse.jetty.ee10:jetty-ee10-jaspi package for Root:Maven. Multiple fixed versions available.
- Record
ROOT-APP-MAVEN-CVE-2026-5795- Updated
- 2026-11-02
OSVSUSE-SU-2026:1751-1 No score
Security update for jetty-minimal
This update for jetty-minimal fixes the following issues:
- CVE-2026-2332: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the 'funky chunks' techniques (bsc#1262115).
- CVE-2026-5795: Fixed JaspiAuthenticator broken access control (bsc#1261997).
- Record
SUSE-SU-2026:1751-1- Updated
- 2026-11-02
Affected products
- eclipse jetty
- eclipse foundation jetty
- red hat hawtio hawtio 4.4.0
- red hat build of apache camel 4.18.1 for spring boot 3.5.14
- red hat data grid 8
- red hat jboss enterprise application platform 8
- red hat jboss enterprise application platform expansion pack
- red hat offline knowledge portal 1.2.12
- red hat openshift dev spaces
- red hat streams for apache kafka 3
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty.ee11:jetty-ee11-jaspiMaven |
12.1.0 to 12.1.7 | 12.1.8 |
org.eclipse.jetty.ee10:jetty-ee10-jaspiMaven |
12.1.0 to 12.1.7 | 12.1.8 |
org.eclipse.jetty.ee9:jetty-ee9-jaspiMaven |
12.1.0 to 12.1.7 | 12.1.8 |
org.eclipse.jetty.ee8:jetty-ee8-jaspiMaven |
12.1.0 to 12.1.7 | 12.1.8 |
org.eclipse.jetty.ee11:jetty-ee11-jaspiMaven |
12.0.0 to 12.0.33 | 12.0.34 |
org.eclipse.jetty.ee10:jetty-ee10-jaspiMaven |
12.0.0 to 12.0.33 | 12.0.34 |
org.eclipse.jetty.ee9:jetty-ee9-jaspiMaven |
12.0.0 to 12.0.33 | 12.0.34 |
org.eclipse.jetty.ee8:jetty-ee8-jaspiMaven |
12.0.0 to 12.0.33 | 12.0.34 |
org.eclipse.jetty:jetty-jaspiMaven |
11.0.0 to 11.0.28 | 11.0.29 |
org.eclipse.jetty:jetty-jaspiMaven |
10.0.0 to 10.0.28 | 10.0.29 |
Show 69 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty:jetty-jaspiMaven |
9.4.0 to 9.4.60 | 9.4.61 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven |
11.0.29 up to 11.0.29.tuxcare0001 | 11.0.29.tuxcare0001 |
org.eclipse.jetty.http2:http2-commonTuxCare:Maven From an advisory covering 2 CVEs |
9.4.61 up to 9.4.61.tuxcare0001 | 9.4.61.tuxcare0001 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven From an advisory covering 2 CVEs |
9.4.61 up to 9.4.61.tuxcare0001 | 9.4.61.tuxcare0001 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven |
10.0.29 up to 10.0.29.tuxcare0001 | 10.0.29.tuxcare0001 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven |
11.0.28 up to 11.0.28-tuxcare.2 | 11.0.28-tuxcare.2 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven |
11.0.27 up to 11.0.27.tuxcare0002, plus listed versions 11.0.27.tuxcare00001 |
11.0.27.tuxcare0002 |
org.eclipse.jetty:jetty-httpTuxCare:Maven From an advisory covering 2 CVEs |
11.0.26 up to 11.0.26-tuxcare.1 | 11.0.26-tuxcare.1 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven From an advisory covering 2 CVEs |
11.0.26 up to 11.0.26-tuxcare.1 | 11.0.26-tuxcare.1 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven |
9.4.58.v20250814 up to 9.4.58.v20250814-tuxcare.1 | 9.4.58.v20250814-tuxcare.1 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven |
10.0.26 up to 10.0.26-tuxcare.1 | 10.0.26-tuxcare.1 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven From an advisory covering 2 CVEs |
10.0.27 up to 10.0.27.tuxcare0004, plus listed versions 10.0.27.tuxcare0000110.0.27.tuxcare000210.0.27.tuxcare0003 |
10.0.27.tuxcare0004 |
org.eclipse.jetty:jetty-serverTuxCare:Maven From an advisory covering 2 CVEs |
10.0.27 up to 10.0.27.tuxcare0004, plus listed versions 10.0.27.tuxcare0000110.0.27.tuxcare000210.0.27.tuxcare0003 |
10.0.27.tuxcare0004 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven From an advisory covering 2 CVEs |
10.0.28 up to 10.0.28.tuxcare0003, plus listed versions 10.0.28.tuxcare000110.0.28.tuxcare0002 |
10.0.28.tuxcare0003 |
org.eclipse.jetty:jetty-serverTuxCare:Maven From an advisory covering 2 CVEs |
10.0.28 up to 10.0.28.tuxcare0003, plus listed versions 10.0.28.tuxcare000110.0.28.tuxcare0002 |
10.0.28.tuxcare0003 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven |
9.4.59 up to 9.4.59.tuxcare0003, plus listed versions 9.4.59.tuxcare000019.4.59.tuxcare0002 |
9.4.59.tuxcare0003 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven |
9.4.57.v20241219 up to 9.4.57.v20241219-tuxcare.5, plus listed versions 9.4.57.v20241219-tuxcare.19.4.57.v20241219-tuxcare.29.4.57.v20241219-tuxcare.39.4.57.v20241219-tuxcare.4 |
9.4.57.v20241219-tuxcare.5 |
org.eclipse.jetty.http2:http2-commonTuxCare:Maven From an advisory covering 4 CVEs |
11.0.18 up to 11.0.18-tuxcare.1 | 11.0.18-tuxcare.1 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven From an advisory covering 4 CVEs |
11.0.18 up to 11.0.18-tuxcare.1 | 11.0.18-tuxcare.1 |
org.eclipse.jetty:jetty-serverTuxCare:Maven From an advisory covering 4 CVEs |
11.0.18 up to 11.0.18-tuxcare.1 | 11.0.18-tuxcare.1 |
org.eclipse.jetty.http2:http2-commonTuxCare:Maven From an advisory covering 4 CVEs |
11.0.19 up to 11.0.19-tuxcare.4, plus listed versions 11.0.19-tuxcare.111.0.19-tuxcare.211.0.19-tuxcare.3 |
11.0.19-tuxcare.4 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven From an advisory covering 4 CVEs |
11.0.19 up to 11.0.19-tuxcare.4, plus listed versions 11.0.19-tuxcare.111.0.19-tuxcare.211.0.19-tuxcare.3 |
11.0.19-tuxcare.4 |
org.eclipse.jetty:jetty-serverTuxCare:Maven From an advisory covering 4 CVEs |
11.0.19 up to 11.0.19-tuxcare.4, plus listed versions 11.0.19-tuxcare.111.0.19-tuxcare.211.0.19-tuxcare.3 |
11.0.19-tuxcare.4 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven From an advisory covering 2 CVEs |
9.2.16.v20160414 up to 9.2.16.v20160414-tuxcare.2, plus listed versions 9.2.16.v20160414-tuxcare.1 |
9.2.16.v20160414-tuxcare.2 |
org.eclipse.jetty:jetty-serverTuxCare:Maven From an advisory covering 2 CVEs |
9.2.16.v20160414 up to 9.2.16.v20160414-tuxcare.2, plus listed versions 9.2.16.v20160414-tuxcare.1 |
9.2.16.v20160414-tuxcare.2 |
org.eclipse.jetty.ee10:jetty-ee10-jaspiTuxCare:Maven From an advisory covering 5 CVEs |
12.0.22 up to 12.0.22-tuxcare.1 | 12.0.22-tuxcare.1 |
org.eclipse.jetty.ee8:jetty-ee8-jaspiTuxCare:Maven From an advisory covering 5 CVEs |
12.0.22 up to 12.0.22-tuxcare.1 | 12.0.22-tuxcare.1 |
org.eclipse.jetty.ee8:jetty-ee8-securityTuxCare:Maven From an advisory covering 5 CVEs |
12.0.22 up to 12.0.22-tuxcare.1 | 12.0.22-tuxcare.1 |
org.eclipse.jetty.ee9:jetty-ee9-jaspiTuxCare:Maven From an advisory covering 5 CVEs |
12.0.22 up to 12.0.22-tuxcare.1 | 12.0.22-tuxcare.1 |
org.eclipse.jetty.ee9:jetty-ee9-securityTuxCare:Maven From an advisory covering 5 CVEs |
12.0.22 up to 12.0.22-tuxcare.1 | 12.0.22-tuxcare.1 |
org.eclipse.jetty.http2:jetty-http2-commonTuxCare:Maven From an advisory covering 5 CVEs |
12.0.22 up to 12.0.22-tuxcare.1 | 12.0.22-tuxcare.1 |
org.eclipse.jetty:jetty-httpTuxCare:Maven From an advisory covering 5 CVEs |
12.0.22 up to 12.0.22-tuxcare.1 | 12.0.22-tuxcare.1 |
org.eclipse.jetty:jetty-securityTuxCare:Maven From an advisory covering 5 CVEs |
12.0.22 up to 12.0.22-tuxcare.1 | 12.0.22-tuxcare.1 |
org.eclipse.jetty:jetty-serverTuxCare:Maven From an advisory covering 5 CVEs |
12.0.22 up to 12.0.22-tuxcare.1 | 12.0.22-tuxcare.1 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven From an advisory covering 2 CVEs |
9.4.50.v20221201 up to 9.4.50.v20221201-tuxcare.6, plus listed versions 9.4.50.v20221201-tuxcare.19.4.50.v20221201-tuxcare.29.4.50.v20221201-tuxcare.39.4.50.v20221201-tuxcare.49.4.50.v20221201-tuxcare.5 |
9.4.50.v20221201-tuxcare.6 |
org.eclipse.jetty:jetty-serverTuxCare:Maven From an advisory covering 2 CVEs |
9.4.50.v20221201 up to 9.4.50.v20221201-tuxcare.6, plus listed versions 9.4.50.v20221201-tuxcare.19.4.50.v20221201-tuxcare.29.4.50.v20221201-tuxcare.39.4.50.v20221201-tuxcare.49.4.50.v20221201-tuxcare.5 |
9.4.50.v20221201-tuxcare.6 |
org.eclipse.jetty:jetty-jaspiTuxCare:Maven From an advisory covering 2 CVEs |
9.4.53.v20231009 up to 9.4.53.v20231009-tuxcare.9, plus listed versions 9.4.53.v20231009-tuxcare.19.4.53.v20231009-tuxcare.29.4.53.v20231009-tuxcare.39.4.53.v20231009-tuxcare.49.4.53.v20231009-tuxcare.59.4.53.v20231009-tuxcare.69.4.53.v20231009-tuxcare.79.4.53.v20231009-tuxcare.8 |
9.4.53.v20231009-tuxcare.9 |
org.eclipse.jetty:jetty-serverTuxCare:Maven From an advisory covering 2 CVEs |
9.4.53.v20231009 up to 9.4.53.v20231009-tuxcare.9, plus listed versions 9.4.53.v20231009-tuxcare.19.4.53.v20231009-tuxcare.29.4.53.v20231009-tuxcare.39.4.53.v20231009-tuxcare.49.4.53.v20231009-tuxcare.59.4.53.v20231009-tuxcare.69.4.53.v20231009-tuxcare.79.4.53.v20231009-tuxcare.8 |
9.4.53.v20231009-tuxcare.9 |
jetty12Debian:13 |
All versions, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-2 Show 4 moreShow less12.0.33-112.0.39-112.0.40-112.0.40-2 |
None known |
jetty12Debian:14 |
before 12.0.39-1, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-212.0.33-1 |
12.0.39-1 |
jetty9Debian:12 |
All versions, plus listed versions 9.4.50-49.4.50-4+deb12u19.4.50-4+deb12u29.4.50-4+deb12u39.4.51-1 Show 13 moreShow less9.4.51-29.4.52-19.4.53-19.4.54-19.4.55-19.4.56-19.4.57-0+deb12u19.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2 |
None known |
jetty9Debian:13 |
All versions, plus listed versions 9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2 |
None known |
jetty9Debian:14 |
All versions, plus listed versions 9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2 |
None known |
org.eclipse.jetty.ee11:jetty-ee11-jaspiMaven |
12.1.0 up to 12.1.8, plus listed versions 12.1.112.1.212.1.312.1.412.1.512.1.612.1.7 |
12.1.8 |
org.eclipse.jetty.ee10:jetty-ee10-jaspiMaven |
12.1.0 up to 12.1.8, plus listed versions 12.1.112.1.212.1.312.1.412.1.512.1.612.1.7 |
12.1.8 |
org.eclipse.jetty.ee9:jetty-ee9-jaspiMaven |
12.1.0 up to 12.1.8, plus listed versions 12.1.112.1.212.1.312.1.412.1.512.1.612.1.7 |
12.1.8 |
org.eclipse.jetty.ee8:jetty-ee8-jaspiMaven |
12.1.0 up to 12.1.8, plus listed versions 12.1.112.1.212.1.312.1.412.1.512.1.612.1.7 |
12.1.8 |
org.eclipse.jetty.ee11:jetty-ee11-jaspiMaven |
12.0.0 up to 12.0.34 | 12.0.34 |
org.eclipse.jetty.ee10:jetty-ee10-jaspiMaven |
12.0.0 up to 12.0.34, plus listed versions 12.0.112.0.1012.0.1112.0.1212.0.13 Show 28 moreShow less12.0.1412.0.1512.0.1612.0.1712.0.1812.0.1912.0.212.0.2012.0.2112.0.2212.0.2312.0.2412.0.2512.0.2612.0.2712.0.2812.0.2912.0.312.0.3012.0.3112.0.3212.0.3312.0.412.0.512.0.612.0.712.0.812.0.9 |
12.0.34 |
org.eclipse.jetty.ee9:jetty-ee9-jaspiMaven |
12.0.0 up to 12.0.34, plus listed versions 12.0.112.0.1012.0.1112.0.1212.0.13 Show 28 moreShow less12.0.1412.0.1512.0.1612.0.1712.0.1812.0.1912.0.212.0.2012.0.2112.0.2212.0.2312.0.2412.0.2512.0.2612.0.2712.0.2812.0.2912.0.312.0.3012.0.3112.0.3212.0.3312.0.412.0.512.0.612.0.712.0.812.0.9 |
12.0.34 |
org.eclipse.jetty.ee8:jetty-ee8-jaspiMaven |
12.0.0 up to 12.0.34, plus listed versions 12.0.1012.0.1112.0.1212.0.1312.0.14 Show 27 moreShow less12.0.1512.0.1612.0.1712.0.1812.0.1912.0.212.0.2012.0.2112.0.2212.0.2312.0.2412.0.2512.0.2612.0.2712.0.2812.0.2912.0.312.0.3012.0.3112.0.3212.0.3312.0.412.0.512.0.612.0.712.0.812.0.9 |
12.0.34 |
org.eclipse.jetty:jetty-jaspiMaven |
11.0.0 up to 11.0.29, plus listed versions 11.0.111.0.1011.0.1111.0.1211.0.13 Show 21 moreShow less11.0.1411.0.1511.0.1611.0.1711.0.1811.0.1911.0.211.0.2011.0.2111.0.2211.0.2311.0.2411.0.2511.0.2611.0.311.0.411.0.511.0.611.0.711.0.811.0.9 |
11.0.29 |
org.eclipse.jetty:jetty-jaspiMaven |
10.0.0 up to 10.0.29, plus listed versions 10.0.110.0.1010.0.1110.0.1210.0.13 Show 21 moreShow less10.0.1410.0.1510.0.1610.0.1710.0.1810.0.1910.0.210.0.2010.0.2110.0.2210.0.2310.0.2410.0.2510.0.2610.0.310.0.410.0.510.0.610.0.710.0.810.0.9 |
10.0.29 |
org.eclipse.jetty:jetty-jaspiMaven |
9.4.0 up to 9.4.61, plus listed versions 9.4.0.v201612089.4.0.v201806199.4.1.v201701209.4.1.v201806199.4.10.RC0 Show 45 moreShow less9.4.10.RC19.4.10.v201805039.4.11.v201806059.4.12.RC09.4.12.RC19.4.12.RC29.4.12.v201808309.4.13.v201811119.4.14.v201811149.4.15.v201902159.4.16.v201904119.4.17.v201904189.4.18.v201904299.4.19.v201906109.4.2.v201702209.4.2.v201806199.4.20.v201908139.4.21.v201909269.4.22.v201910229.4.23.v201911189.4.24.v201911209.4.25.v201912209.4.26.v202001179.4.27.v202002279.4.28.v202004089.4.29.v202005219.4.3.v201703179.4.3.v201806199.4.30.v202006119.4.31.v202007239.4.32.v202009309.4.33.v202010209.4.34.v202011029.4.35.v202011209.4.36.v202101149.4.37.v202102199.4.38.v202102249.4.39.v202103259.4.4.v201704149.4.4.v201806199.4.40.v202104139.4.41.v202105169.4.42.v202106049.4.43.v202106299.4.44.v20210927 |
9.4.61 |
org.eclipse.jetty.ee10:jetty-ee10-jaspiRoot:Maven |
before 12.0.13-aikido.7 | 12.0.13-aikido.712.0.3-aikido.712.0.13-aikido.812.0.13-aikido.912.0.16-aikido.412.0.3-aikido.812.0.13-aikido.1012.0.16-aikido.512.0.3-aikido.912.0.33-aikido.3 |
org.eclipse.jetty.ee11:jetty-ee11-jaspiRoot:Maven |
before 12.1.7-aikido.1 | 12.1.7-aikido.1 |
io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspiRoot:Maven |
before 12.0.3-root.io.3 | 12.0.3-root.io.312.0.13-root.io.612.0.16-root.io.212.0.3-root.io.412.0.3-root.io.512.0.3-root.io.612.0.13-root.io.712.0.3-root.io.712.0.16-root.io.312.0.13-root.io.812.0.13-root.io.912.0.16-root.io.412.0.3-root.io.812.0.13-root.io.1012.0.16-root.io.512.0.3-root.io.912.0.33-root.io.3 |
io.root.org.eclipse.jetty.ee11:jetty-ee11-jaspiRoot:Maven |
before 12.1.7-root.io.1 | 12.1.7-root.io.1 |
jettyUbuntu:14.04:LTS |
All versions, plus listed versions 6.1.26-1ubuntu16.1.26-1ubuntu1.16.1.26-1ubuntu1.2 |
None known |
jettyUbuntu:16.04:LTS |
All versions, plus listed versions 6.1.26-56.1.26-5ubuntu0.1 |
None known |
jetty9Ubuntu:16.04:LTS |
All versions, plus listed versions 9.2.14-1 |
None known |
jetty9Ubuntu:18.04:LTS |
All versions, plus listed versions 9.2.22-29.2.22-39.2.23-19.4.15-1~18.04.1ubuntu1 |
None known |
jetty9Ubuntu:20.04:LTS |
All versions, plus listed versions 9.4.18-2build29.4.26-1 |
None known |
jetty9Ubuntu:22.04:LTS |
All versions, plus listed versions 9.4.39-39.4.44-29.4.44-39.4.44-49.4.45-1 |
None known |
jetty9Ubuntu:24.04:LTS |
All versions, plus listed versions 9.4.51-29.4.53-1 |
None known |
jetty9Ubuntu:25.10 |
All versions, plus listed versions 9.4.56-19.4.57-1 |
None known |
jetty9Ubuntu:26.10 |
All versions, plus listed versions 9.4.58-19.4.58-2 |
None known |
jetty9Ubuntu:26.04:LTS |
All versions, plus listed versions 9.4.57-19.4.57-1.19.4.58-1 |
None known |
jetty-minimalopenSUSE:Tumbleweed From an advisory covering 2 CVEs |
before 9.4.58-4.1 | 9.4.58-4.1 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| affected, aliases | OSV | |
| affected, aliases | OSV | |
| affected, facts | OSV | |
| affected | ||
| affected, affected_more | OSV | |
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2026-5795 is a high vulnerability (CVSS 7.4) in Eclipse Jetty, published April 8, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.54%, the 45th percentile. Fixed in org.eclipse.jetty.ee11:jetty-ee11-jaspi 12.1.8.
References
github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps:/
gitlab.eclipse.org/security/cve-assignment/-/issues/92
access.redhat.com/security/cve/CVE-2026-5795
bugzilla.redhat.com/show_bug.cgi?id=2456519
security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5795.json
Show 17 moreShow less
nvd.nist.gov/vuln/detail/CVE-2026-5795
security-tracker.debian.org/tracker/CVE-2026-5795
suse.com/support/update/announcement/2026/suse-su-20261751-1
bugzilla.suse.com/1261997
ubuntu.com/security/CVE-2026-5795
cve.org/CVERecord?id=CVE-2026-5795
Left out here: 24 versions. The JSON record has them.