{"id":"CVE-2026-5795","aliases":["CLSA-2026-1775781156","CLSA-2026-1775781157","CLSA-2026-1775781158","CLSA-2026-1777336763","CLSA-2026-1778201085","CLSA-2026-1779238058","CLSA-2026-1779324478","CLSA-2026-1779324480","CLSA-2026-1786356731","CLSA-2026-1786358468","CLSA-2026-1786437309","CLSA-2026-1786550111","CLSA-2026-1792753531","CLSA-2026-1792756836","CLSA-2026-1792769441","CLSA-2026-1793132217","CLSA-2026-1793790043","CLSA-2026-1793798237","CLSA-2026-1794240586","CLSA-2026-1794251641","CLSA-2026-1794255593","CLSA-2026-1794257649","DEBIAN-CVE-2026-5795","EUVD-2026-20473","GHSA-gc59-r5jq-98qw","GHSA-r7p8-xq5m-436c","ROOT-APP-MAVEN-CVE-2026-5795","SUSE-SU-2026:1751-1","UBUNTU-CVE-2026-5795","openSUSE-SU-2026:10574-1"],"status":"published","title":"Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables","description":"In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.","severity":{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00538,"percentile":0.45618,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-226","CWE-287"],"published":"2026-04-08T13:32:28Z","modified":"2026-11-10T01:15:05Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty.ee11:jetty-ee11-jaspi","fixed_in":["12.1.8","12.0.34"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","fixed_in":["12.1.8","12.0.34"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","fixed_in":["12.1.8","12.0.34"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","fixed_in":["12.1.8","12.0.34"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-jaspi","fixed_in":["11.0.29","10.0.29","9.4.61"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","fixed_in":["11.0.29.tuxcare0001","10.0.29.tuxcare0001","11.0.28-tuxcare.2","11.0.27.tuxcare0002","9.4.58.v20250814-tuxcare.1","10.0.26-tuxcare.1","9.4.59.tuxcare0003","9.4.57.v20241219-tuxcare.5","9.4.48.v20220622-tuxcare.6"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty12","fixed_in":["12.0.39-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","fixed_in":["12.0.13-aikido.7","12.0.3-aikido.7","12.0.13-aikido.8","12.0.13-aikido.9","12.0.16-aikido.4","12.0.3-aikido.8","12.0.13-aikido.10","12.0.16-aikido.5","12.0.3-aikido.9","12.0.33-aikido.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.eclipse.jetty.ee11:jetty-ee11-jaspi","fixed_in":["12.1.7-aikido.1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi","fixed_in":["12.0.3-root.io.3","12.0.13-root.io.6","12.0.16-root.io.2","12.0.3-root.io.4","12.0.3-root.io.5","12.0.3-root.io.6","12.0.13-root.io.7","12.0.3-root.io.7","12.0.16-root.io.3","12.0.13-root.io.8","12.0.13-root.io.9","12.0.16-root.io.4","12.0.3-root.io.8","12.0.13-root.io.10","12.0.16-root.io.5","12.0.3-root.io.9","12.0.33-root.io.3"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty.ee11:jetty-ee11-jaspi","fixed_in":["12.1.7-root.io.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee11:jetty-ee11-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.7"},{"fixed":"12.1.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.7"},{"fixed":"12.1.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.7"},{"fixed":"12.1.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.7"},{"fixed":"12.1.8"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee11:jetty-ee11-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.33"},{"fixed":"12.0.34"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.33"},{"fixed":"12.0.34"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.33"},{"fixed":"12.0.34"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.33"},{"fixed":"12.0.34"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.0.28"},{"fixed":"11.0.29"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.0.28"},{"fixed":"10.0.29"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"last_affected":"9.4.60"},{"fixed":"9.4.61"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.29"},{"fixed":"11.0.29.tuxcare0001"}]}],"versions":["11.0.29"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.61"},{"fixed":"9.4.61.tuxcare0001"}]}],"versions":["9.4.61"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.61"},{"fixed":"9.4.61.tuxcare0001"}]}],"versions":["9.4.61"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.29"},{"fixed":"10.0.29.tuxcare0001"}]}],"versions":["10.0.29"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.28"},{"fixed":"11.0.28-tuxcare.2"}]}],"versions":["11.0.28"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.27"},{"fixed":"11.0.27.tuxcare0002"}]}],"versions":["11.0.27","11.0.27.tuxcare00001"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.26"},{"fixed":"11.0.26-tuxcare.1"}]}],"versions":["11.0.26"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.26"},{"fixed":"11.0.26-tuxcare.1"}]}],"versions":["11.0.26"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.58.v20250814"},{"fixed":"9.4.58.v20250814-tuxcare.1"}]}],"versions":["9.4.58.v20250814"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.26"},{"fixed":"10.0.26-tuxcare.1"}]}],"versions":["10.0.26"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.27"},{"fixed":"10.0.27.tuxcare0004"}]}],"versions":["10.0.27","10.0.27.tuxcare00001","10.0.27.tuxcare0002","10.0.27.tuxcare0003"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.27"},{"fixed":"10.0.27.tuxcare0004"}]}],"versions":["10.0.27","10.0.27.tuxcare00001","10.0.27.tuxcare0002","10.0.27.tuxcare0003"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.28"},{"fixed":"10.0.28.tuxcare0003"}]}],"versions":["10.0.28","10.0.28.tuxcare0001","10.0.28.tuxcare0002"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.28"},{"fixed":"10.0.28.tuxcare0003"}]}],"versions":["10.0.28","10.0.28.tuxcare0001","10.0.28.tuxcare0002"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.59"},{"fixed":"9.4.59.tuxcare0003"}]}],"versions":["9.4.59","9.4.59.tuxcare00001","9.4.59.tuxcare0002"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.57.v20241219"},{"fixed":"9.4.57.v20241219-tuxcare.5"}]}],"versions":["9.4.57.v20241219","9.4.57.v20241219-tuxcare.1","9.4.57.v20241219-tuxcare.2","9.4.57.v20241219-tuxcare.3","9.4.57.v20241219-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.1"}]}],"versions":["11.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.1"}]}],"versions":["11.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.1"}]}],"versions":["11.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.4"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.4"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.4"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.2.16.v20160414"},{"fixed":"9.2.16.v20160414-tuxcare.2"}]}],"versions":["9.2.16.v20160414","9.2.16.v20160414-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.2.16.v20160414"},{"fixed":"9.2.16.v20160414-tuxcare.2"}]}],"versions":["9.2.16.v20160414","9.2.16.v20160414-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.6"}]}],"versions":["9.4.50.v20221201","9.4.50.v20221201-tuxcare.1","9.4.50.v20221201-tuxcare.2","9.4.50.v20221201-tuxcare.3","9.4.50.v20221201-tuxcare.4","9.4.50.v20221201-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.6"}]}],"versions":["9.4.50.v20221201","9.4.50.v20221201-tuxcare.1","9.4.50.v20221201-tuxcare.2","9.4.50.v20221201-tuxcare.3","9.4.50.v20221201-tuxcare.4","9.4.50.v20221201-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.53.v20231009"},{"fixed":"9.4.53.v20231009-tuxcare.9"}]}],"versions":["9.4.53.v20231009","9.4.53.v20231009-tuxcare.1","9.4.53.v20231009-tuxcare.2","9.4.53.v20231009-tuxcare.3","9.4.53.v20231009-tuxcare.4","9.4.53.v20231009-tuxcare.5","9.4.53.v20231009-tuxcare.6","9.4.53.v20231009-tuxcare.7","9.4.53.v20231009-tuxcare.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.53.v20231009"},{"fixed":"9.4.53.v20231009-tuxcare.9"}]}],"versions":["9.4.53.v20231009","9.4.53.v20231009-tuxcare.1","9.4.53.v20231009-tuxcare.2","9.4.53.v20231009-tuxcare.3","9.4.53.v20231009-tuxcare.4","9.4.53.v20231009-tuxcare.5","9.4.53.v20231009-tuxcare.6","9.4.53.v20231009-tuxcare.7","9.4.53.v20231009-tuxcare.8"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.60"},{"fixed":"9.4.60.tuxcare0004"}]}],"versions":["9.4.60","9.4.60.tuxcare0001","9.4.60.tuxcare0002","9.4.60.tuxcare0003"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.60"},{"fixed":"9.4.60.tuxcare0004"}]}],"versions":["9.4.60","9.4.60.tuxcare0001","9.4.60.tuxcare0002","9.4.60.tuxcare0003"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.6"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1","9.4.48.v20220622-tuxcare.2","9.4.48.v20220622-tuxcare.3","9.4.48.v20220622-tuxcare.4","9.4.48.v20220622-tuxcare.5"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.24.v20191120"},{"fixed":"9.4.24.v20191120-tuxcare.6"}]}],"versions":["9.4.24.v20191120","9.4.24.v20191120-tuxcare.1","9.4.24.v20191120-tuxcare.2","9.4.24.v20191120-tuxcare.3","9.4.24.v20191120-tuxcare.4","9.4.24.v20191120-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.24.v20191120"},{"fixed":"9.4.24.v20191120-tuxcare.6"}]}],"versions":["9.4.24.v20191120","9.4.24.v20191120-tuxcare.1","9.4.24.v20191120-tuxcare.2","9.4.24.v20191120-tuxcare.3","9.4.24.v20191120-tuxcare.4","9.4.24.v20191120-tuxcare.5"],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1","12.0.39-1","12.0.40-1","12.0.40-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.39-1"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee11:jetty-ee11-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.8"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.8"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.8"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.8"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee11:jetty-ee11-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.34"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.34"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.34"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.34"}]}],"versions":["12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.29"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.26","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.29"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.0"},{"fixed":"9.4.61"}]}],"versions":["9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.53.v20231009","9.4.54.v20240208","9.4.55.v20240627","9.4.56.v20240826","9.4.57.v20241219","9.4.58.v20250814","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.13-aikido.7"},{"fixed":"12.0.3-aikido.7"},{"fixed":"12.0.13-aikido.8"},{"fixed":"12.0.13-aikido.9"},{"fixed":"12.0.16-aikido.4"},{"fixed":"12.0.3-aikido.8"},{"fixed":"12.0.13-aikido.10"},{"fixed":"12.0.16-aikido.5"},{"fixed":"12.0.3-aikido.9"},{"fixed":"12.0.33-aikido.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.eclipse.jetty.ee11:jetty-ee11-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.7-aikido.1"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-root.io.3"},{"fixed":"12.0.13-root.io.6"},{"fixed":"12.0.16-root.io.2"},{"fixed":"12.0.3-root.io.4"},{"fixed":"12.0.3-root.io.5"},{"fixed":"12.0.3-root.io.6"},{"fixed":"12.0.13-root.io.7"},{"fixed":"12.0.3-root.io.7"},{"fixed":"12.0.16-root.io.3"},{"fixed":"12.0.13-root.io.8"},{"fixed":"12.0.13-root.io.9"},{"fixed":"12.0.16-root.io.4"},{"fixed":"12.0.3-root.io.8"},{"fixed":"12.0.13-root.io.10"},{"fixed":"12.0.16-root.io.5"},{"fixed":"12.0.3-root.io.9"},{"fixed":"12.0.33-root.io.3"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty.ee11:jetty-ee11-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.1.7-root.io.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-1ubuntu1","6.1.26-1ubuntu1.1","6.1.26-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-5","6.1.26-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.56-1","9.4.57-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-4.1"}]}],"bundled":2}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"red hat","product":"hawtio hawtio 4.4.0"},{"vendor":"red hat","product":"red hat build of apache camel 4.18.1 for spring boot 3.5.14"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat offline knowledge portal 1.2.12"},{"vendor":"red hat","product":"red hat openshift dev spaces"},{"vendor":"red hat","product":"streams for apache kafka 3"}],"references":[{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps://","tags":["Broken Link","advisory","report"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/issues/92","tags":["Broken Link","report","web"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-5795","tags":["vdb-entry","x_refsource_REDHAT","advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2456519","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-5795.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25089","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:28573","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:17668","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-5795","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c","tags":["web"]},{"url":"https://github.com/advisories/GHSA-gc59-r5jq-98qw"},{"url":"https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf","tags":["web"]},{"url":"https://github.com/advisories/GHSA-r7p8-xq5m-436c"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/5xxx/CVE-2026-5795.json","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-5795","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2026/suse-su-20261751-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1261997","tags":["report"]},{"url":"https://bugzilla.suse.com/1262115","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2026-2332","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2026-5795","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2026-5795","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-5795","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2026-5795","description":"In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.","status":"published","published":"2026-04-08T13:32:28.935Z","modified":"2026-09-14T12:04:27.326Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"cna"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"adp"}],"cwes":["CWE-226","CWE-287","CWE-226"],"updated_at":"2026-11-02T13:39:16.730222Z"}],"euvd":[{"id":"EUVD-2026-20473","description":"In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.","status":"published","published":"2026-04-08T13:32:28Z","modified":"2026-09-14T12:04:27Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T17:28:21.2136Z"}],"ghsa":[{"id":"GHSA-gc59-r5jq-98qw","title":"Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r7p8-xq5m-436c. This link is maintained to preserve external references.\n\n## Original Description\nIn Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.","status":"withdrawn","published":"2026-04-08T15:31:44Z","modified":"2026-04-14T00:06:20Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-226"],"updated_at":"2026-11-02T14:39:53.087746Z"},{"id":"GHSA-r7p8-xq5m-436c","title":"Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables","description":"### Description (as reported)\n\nA security vulnerability has been identified in Jetty's  `JaspiAuthenticator.java`. \n\nThe root cause is a failure to consistently clear authentication metadata stored in  `ThreadLocal`  during certain error or incomplete authentication flows. \nSpecifically, after a `GroupPrincipalCallback`  is persisted into the  `ThreadLocal`, the authentication process may exit prematurely — before the  `ThreadLocal`  storage is cleared — if a mandatory `CallerPrincipalCallback`  is missing or an exception occurs. \nThis allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.\n\nSee also attached PDF.\n\n### Impact\nAn unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).\n\n### Patches\nNo patches yet.\n\n### Workarounds\nDo not use Jetty's JASPI.","status":"published","published":"2026-04-14T00:06:27Z","modified":"2026-04-14T00:06:30Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-226","CWE-287"],"updated_at":"2026-11-02T14:39:53.087746Z"}],"nvd":[{"id":"CVE-2026-5795","description":"In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.","status":"published","published":"2026-04-08T14:16:32.633Z","modified":"2026-09-14T13:18:42.263Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high","assessor":"secondary"}],"cwes":["CWE-226","CWE-287"],"updated_at":"2026-11-02T14:12:13.535987Z"}],"osv":[{"id":"CVE-2026-5795","description":"In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.","status":"published","published":"2026-04-08T13:32:28.935Z","modified":"2026-10-28T02:30:57.683130618Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-226","CWE-287"],"updated_at":"2026-11-02T15:45:12.016252Z"},{"id":"DEBIAN-CVE-2026-5795","description":"In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.   Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.   A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.","status":"published","published":"2026-04-08T14:16:32.633Z","modified":"2026-11-04T06:00:08.539510038Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-04T06:29:21.687524Z"},{"id":"GHSA-gc59-r5jq-98qw","title":"Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables","description":"## Duplicate Advisory\n\nThis advisory has been withdrawn because it is a duplicate of GHSA-r7p8-xq5m-436c. This link is maintained to preserve external references.\n\n## Original Description\nIn Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.","status":"withdrawn","published":"2026-04-08T15:31:44Z","modified":"2026-09-10T03:50:44.528795752Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-226"],"updated_at":"2026-11-02T15:46:47.472172Z"},{"id":"GHSA-r7p8-xq5m-436c","title":"Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables","description":"### Description (as reported)\n\nA security vulnerability has been identified in Jetty's  `JaspiAuthenticator.java`. \n\nThe root cause is a failure to consistently clear authentication metadata stored in  `ThreadLocal`  during certain error or incomplete authentication flows. \nSpecifically, after a `GroupPrincipalCallback`  is persisted into the  `ThreadLocal`, the authentication process may exit prematurely — before the  `ThreadLocal`  storage is cleared — if a mandatory `CallerPrincipalCallback`  is missing or an exception occurs. \nThis allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.\n\nSee also attached PDF.\n\n### Impact\nAn unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).\n\n### Patches\nNo patches yet.\n\n### Workarounds\nDo not use Jetty's JASPI.","status":"published","published":"2026-04-14T00:06:27Z","modified":"2026-04-14T00:40:59.663812Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"cwes":["CWE-226","CWE-287"],"updated_at":"2026-11-02T15:46:55.480549Z"},{"id":"UBUNTU-CVE-2026-5795","description":"In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.","status":"published","published":"2026-04-08T14:16:00Z","modified":"2026-10-17T13:00:28.310707534Z","cvss":[{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"},{"version":"3.1","score":7.4,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T16:56:41.911783Z"},{"id":"CLSA-2026-1775781156","title":"TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 11.0.29.tuxcare0001.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-30T19:45:15.808587572Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775781157","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.61.tuxcare0001.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-30T19:45:02.851052421Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1775781158","title":"TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 10.0.29.tuxcare0001.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-30T19:45:19.47534345Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1777336763","title":"TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 11.0.28-tuxcare.2.","status":"published","published":"2026-08-04T14:52:29Z","modified":"2026-10-30T19:45:19.716963741Z","updated_at":"2026-11-02T15:43:44.384419Z"},{"id":"CLSA-2026-1778201085","title":"TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 11.0.27.tuxcare0002.","status":"published","published":"2026-08-04T14:52:30Z","modified":"2026-10-30T19:45:21.341624112Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779238058","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 11.0.26-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-11-02T19:45:32.145834192Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1779324478","title":"TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 9.4.58.v20250814-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-11-02T19:45:31.196265231Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1779324480","title":"TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 10.0.26-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-10-30T19:45:22.286109835Z","updated_at":"2026-11-02T15:43:45.090939Z"},{"id":"CLSA-2026-1786356731","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 10.0.27.tuxcare0004.","status":"published","published":"2026-08-10T10:12:11Z","modified":"2026-11-02T19:45:48.816189577Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786358468","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 10.0.28.tuxcare0003.","status":"published","published":"2026-08-10T10:41:08Z","modified":"2026-11-02T19:45:48.486707663Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1786437309","title":"TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 9.4.59.tuxcare0003.","status":"published","published":"2026-08-11T08:35:09Z","modified":"2026-10-30T19:45:27.475132464Z","updated_at":"2026-11-02T15:43:46.850893Z"},{"id":"CLSA-2026-1786550111","title":"TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 9.4.57.v20241219-tuxcare.5.","status":"published","published":"2026-08-12T15:55:11Z","modified":"2026-11-02T19:45:56.189376751Z","updated_at":"2026-11-02T20:29:50.522328Z"},{"id":"CLSA-2026-1792753531","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 11.0.18-tuxcare.1.","status":"published","published":"2026-10-23T11:05:31Z","modified":"2026-11-02T19:46:31.49054063Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792756836","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 11.0.19-tuxcare.4.","status":"published","published":"2026-10-23T12:00:36Z","modified":"2026-11-02T19:46:31.630808482Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792769441","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.2.16.v20160414-tuxcare.2.","status":"published","published":"2026-10-23T15:30:41Z","modified":"2026-11-02T19:46:31.595061763Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793132217","title":"TuxCare security update for 9 packages (5 CVEs)","description":"TuxCare rebuilt 9 packages to address 5 CVEs. Fixed in 12.0.22-tuxcare.1.","status":"published","published":"2026-10-27T20:16:57Z","modified":"2026-11-02T19:46:32.652202463Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1793790043","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.50.v20221201-tuxcare.6.","status":"published","published":"2026-11-04T12:00:44Z","modified":"2026-11-04T14:45:05.828051472Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"CLSA-2026-1793798237","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.53.v20231009-tuxcare.9.","status":"published","published":"2026-11-04T14:17:18Z","modified":"2026-11-04T19:00:37.392216906Z","updated_at":"2026-11-04T19:15:03.6858Z"},{"id":"CLSA-2026-1794240586","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.60.tuxcare0004.","status":"published","published":"2026-11-09T17:09:47Z","modified":"2026-11-09T19:15:15.029692942Z","updated_at":"2026-11-09T19:38:09.278998Z"},{"id":"CLSA-2026-1794251641","title":"TuxCare security update for 5 packages (5 CVEs)","description":"TuxCare rebuilt 5 packages to address 5 CVEs. Fixed in 9.4.51.v20230217-tuxcare.2.","status":"published","published":"2026-11-09T20:14:02Z","modified":"2026-11-10T01:15:05.398922343Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794255593","title":"TuxCare security update for org.eclipse.jetty:jetty-jaspi (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-jaspi to address 1 CVE. Fixed in 9.4.48.v20220622-tuxcare.6.","status":"published","published":"2026-11-09T21:19:54Z","modified":"2026-11-10T01:15:02.468122447Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"CLSA-2026-1794257649","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 9.4.24.v20191120-tuxcare.6.","status":"published","published":"2026-11-09T21:54:10Z","modified":"2026-11-10T01:15:04.445685347Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"openSUSE-SU-2026:10574-1","title":"jetty-annotations-9.4.58-4.1 on GA media","description":"These are all security issues fixed in the jetty-annotations-9.4.58-4.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2026-04-18T00:00:00Z","modified":"2026-04-19T10:30:28.426972Z","updated_at":"2026-11-02T16:58:38.415593Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-5795","title":"CVE-2026-5795 in org.eclipse.jetty.ee10:jetty-ee10-jaspi - Patched by Root","description":"Root has patched CVE-2026-5795 in the org.eclipse.jetty.ee10:jetty-ee10-jaspi package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-29T13:11:40Z","modified":"2026-09-29T14:15:02.552661582Z","updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"SUSE-SU-2026:1751-1","title":"Security update for jetty-minimal","description":"This update for jetty-minimal fixes the following issues:\n\n- CVE-2026-2332: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the 'funky chunks' techniques (bsc#1262115).\n- CVE-2026-5795: Fixed JaspiAuthenticator broken access control (bsc#1261997).\n","status":"published","published":"2026-05-07T11:53:44Z","modified":"2026-05-08T08:15:57.046501Z","updated_at":"2026-11-02T15:54:01.610851Z"}]}}