{"id":"CVE-2026-8384","aliases":["DEBIAN-CVE-2026-8384","EUVD-2026-43647","GHSA-w7x5-g22v-xqhr","UBUNTU-CVE-2026-8384"],"status":"published","title":"Eclipse Jetty: Path parameter traversal","description":"In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.","severity":{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0033,"percentile":0.26367,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-647"],"published":"2026-07-14T08:56:17Z","modified":"2026-11-04T06:00:09Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-util","fixed_in":["12.0.35","12.1.9"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"jetty12","fixed_in":["12.0.39-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.34"},{"fixed":"12.0.35"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.8"},{"fixed":"12.1.9"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1","12.0.39-1","12.0.40-1","12.0.40-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.39-1"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.35"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.32","12.0.33","12.0.34","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.9"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5","12.1.6","12.1.7","12.1.8"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3.1","12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"}],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108","tags":["Vendor Advisory","Exploit","web","report"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-w7x5-g22v-xqhr","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8384","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project/pull/14969","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/pull/14973","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/82969c77f6da46e27008b10b3c14840cd31db084","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/ade27ce93a37c33278720250d85c48601230ae3f","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.35","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.9","tags":["web"]},{"url":"https://github.com/advisories/GHSA-w7x5-g22v-xqhr"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/8xxx/CVE-2026-8384.json","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-8384","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-8384","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-8384","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-8384","description":"In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.","status":"published","published":"2026-07-14T08:56:17.525Z","modified":"2026-07-14T12:18:29.831Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T13:48:13.398044Z"}],"euvd":[{"id":"EUVD-2026-43647","description":"In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.","status":"published","published":"2026-07-14T08:56:17Z","modified":"2026-07-14T12:18:29Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T18:20:00.696533Z"}],"ghsa":[{"id":"GHSA-w7x5-g22v-xqhr","title":"Eclipse Jetty: Path parameter traversal","description":"### Description (as reported)\n\n#### Summary\n\nIn Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath() may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot\n  segment.\n\nA minimal example is:\n\n`/public;/../admin/secret`\n\nIn my local reproduction, URIUtil.canonicalPath() returns:\n\n`/public/../admin/secret`\n\ninstead of the expected normalized path:\n\n`/admin/secret`\n\nWhen Jetty's `SecurityHandler.PathMapped` is used to protect a path prefix such as `/admin/*`, the non-normalized canonical path may not match the protected prefix. As a result, an unauthenticated request may bypass the configured path-based security constraint.\n\n\n\n#### Tested Version\n\nJetty: 12.1.8\nJDK: 17.0.18\nMaven: 3.9.14\n\nMaven artifacts used:\n\n  org.eclipse.jetty:jetty-server:12.1.8\n  org.eclipse.jetty:jetty-security:12.1.8\n  org.eclipse.jetty:jetty-session:12.1.8\n\nOnly confirmed Jetty 12.1.8 so far. \n\n\n#### Minimal Reproduction\n\nStarts a minimal Jetty server with the following security setup:\n\n```java\nSecurityHandler.PathMapped security = new SecurityHandler.PathMapped();\nsecurity.put(\"/admin/*\", Constraint.from(\"admin\"));\nsecurity.put(\"/*\", Constraint.ALLOWED);\nsecurity.setAuthenticator(new BasicAuthenticator());\n```\n\nThe test then sends requests with no `Authorization` header.\n\nObserved result:\n\n```\nGET /admin/secret                  -\u003e 401\nGET /public;x/../admin/secret      -\u003e 200\n```\n\nThe handler receives paths such as:\n\n`/public/../admin/secret`\n\nThis suggests that the `/admin/*` security constraint is bypassed because `PathMapped` matching is performed against the non-normalized canonical path.\n\n\n#### Suspected Root Cause\n\nThe suspected root cause is in `URIUtil.canonicalPath()`.\n\nThe relevant logic is approximately:\n\n```java\n    for (int i = 0; i \u003c end; i++)\n    {\n        char c = encodedPath.charAt(i);\n\n        switch (c)\n        {\n            case ';':\n                if (builder == null)\n                {\n                    builder = new Utf8StringBuilder(encodedPath.length());\n                    builder.append(encodedPath, 0, i);\n                }\n\n                while (++i \u003c end)\n                {\n                    if (encodedPath.charAt(i) == '/')\n                    {\n                        builder.append('/');\n                        break;\n                    }\n                }\n                break;\n\n            case '.':\n                if (slash)\n                    normal = false;\n                if (builder != null)\n                    builder.append(c);\n                break;\n        }\n\n        slash = c == '/';\n    }\n\n    String canonical = (builder != null)\n        ? (onBadUtf8 == null ? builder.toCompleteString() : builder.takeCompleteString(onBadUtf8))\n        : encodedPath;\n    return normal ? canonical : normalizePath(canonical);\n```\n\nFor the input:\n\n`/public;/../admin/secret`\n\nwhen the outer loop reaches the semicolon:\n\n```\n    i      = 7\n    c      = ';'\n    slash  = false\n    normal = true\n```\n\nInside `case ';'`, the `while (++i \u003c end)` loop advances i to the next character, which is already '/' for the empty path parameter form \";/\".\n\nThe code then appends '/' to the canonical builder:\n\n`builder.append('/');`\n\nAt this point, the canonical builder ends with '/':\n\n`/public/`\n\nHowever, the local variable `c` is still the old value ';', because `c` was read before entering the switch and is not updated when the inner loop advances `i`.\n\nAfter leaving the switch, the loop updates the slash state using:\n\n`slash = c == '/';`\n\nSince `c` is still ';', slash becomes `false`.\n\nOn the next iteration, the scanner reaches '.', which is the first dot in the following \"../\" segment. Because slash is incorrectly `false`, this code does not run:\n\n```java\n    if (slash)\n        normal = false;\n```\n\nTherefore `normal` remains `true`, and `canonicalPath()` returns the canonical string directly instead of calling `normalizePath(canonical)`.\n\nThe result is:\n\n`/public/../admin/secret`\n\ninstead of:\n\n`/admin/secret`\n\nIn short:\n\n`case ';'` advances the scan position i and appends '/' to the canonical builder, but the loop tail still updates slash from the stale character `c=';'`. As a result, the following dot-dot segment is not detected as a path traversal segment.\n\n####  More Precise Trigger Condition\n\nThe issue is not limited to a non-empty path parameter such as \";x\".\n\nThe more precise trigger shape is:\n\n`;[^/]*/.`\n\nExamples:\n\n```\n    /public;/../admin/secret\n    /public;x/../admin/secret\n    /public;anything/../admin/secret\n    /public;/./admin/secret\n```\n\nThe minimal form is:\n\n`/public;/../admin/secret`\n\nbecause the semicolon is immediately followed by '/', so the inner while loop reaches '/' on its first increment.\n\n####  Potential Minimal Fix Direction\n\nA minimal fix would be to ensure that, when case ';' consumes input until '/' and appends '/' to the canonical builder, the slash state reflects the last effective character in the canonical path.\n\nFor example, conceptually:\n\n```java\n    case ';':\n        if (builder == null)\n        {\n            builder = new Utf8StringBuilder(encodedPath.length());\n            builder.append(encodedPath, 0, i);\n        }\n\n        while (++i \u003c end)\n        {\n            if (encodedPath.charAt(i) == '/')\n            {\n                builder.append('/');\n                slash = true;\n                break;\n            }\n        }\n        continue;\n```\n\nThe important part is to avoid the loop tail from overwriting slash using the stale `c` value:\n\n`slash = c == '/';`\n\nIn other words, `slash` should represent the last effective character appended to the canonical builder, not the original input character read before case ';' advanced `i`.","status":"published","published":"2026-07-22T22:57:36Z","modified":"2026-07-22T22:57:38Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T14:40:51.375752Z"}],"nvd":[{"id":"CVE-2026-8384","description":"In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.","status":"published","published":"2026-07-14T09:16:42.05Z","modified":"2026-10-24T21:10:00.13Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"secondary"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T14:12:29.114188Z"}],"osv":[{"id":"CVE-2026-8384","description":"In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.","status":"published","published":"2026-07-14T08:56:17.525Z","modified":"2026-10-28T02:30:51.001630292Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T15:45:18.482949Z"},{"id":"DEBIAN-CVE-2026-8384","description":"In Eclipse Jetty, an HTTP URI of this form:      /public;/../admin/secret.txt         results in an unresolved path of:      /public/../admin/secret.txt         instead of the expected:      /admin/secret.txt         Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).     However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.","status":"published","published":"2026-07-14T09:16:42.05Z","modified":"2026-11-04T06:00:09.487114058Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-04T06:29:21.687524Z"},{"id":"GHSA-w7x5-g22v-xqhr","title":"Eclipse Jetty: Path parameter traversal","description":"### Description (as reported)\n\n#### Summary\n\nIn Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath() may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot\n  segment.\n\nA minimal example is:\n\n`/public;/../admin/secret`\n\nIn my local reproduction, URIUtil.canonicalPath() returns:\n\n`/public/../admin/secret`\n\ninstead of the expected normalized path:\n\n`/admin/secret`\n\nWhen Jetty's `SecurityHandler.PathMapped` is used to protect a path prefix such as `/admin/*`, the non-normalized canonical path may not match the protected prefix. As a result, an unauthenticated request may bypass the configured path-based security constraint.\n\n\n\n#### Tested Version\n\nJetty: 12.1.8\nJDK: 17.0.18\nMaven: 3.9.14\n\nMaven artifacts used:\n\n  org.eclipse.jetty:jetty-server:12.1.8\n  org.eclipse.jetty:jetty-security:12.1.8\n  org.eclipse.jetty:jetty-session:12.1.8\n\nOnly confirmed Jetty 12.1.8 so far. \n\n\n#### Minimal Reproduction\n\nStarts a minimal Jetty server with the following security setup:\n\n```java\nSecurityHandler.PathMapped security = new SecurityHandler.PathMapped();\nsecurity.put(\"/admin/*\", Constraint.from(\"admin\"));\nsecurity.put(\"/*\", Constraint.ALLOWED);\nsecurity.setAuthenticator(new BasicAuthenticator());\n```\n\nThe test then sends requests with no `Authorization` header.\n\nObserved result:\n\n```\nGET /admin/secret                  -\u003e 401\nGET /public;x/../admin/secret      -\u003e 200\n```\n\nThe handler receives paths such as:\n\n`/public/../admin/secret`\n\nThis suggests that the `/admin/*` security constraint is bypassed because `PathMapped` matching is performed against the non-normalized canonical path.\n\n\n#### Suspected Root Cause\n\nThe suspected root cause is in `URIUtil.canonicalPath()`.\n\nThe relevant logic is approximately:\n\n```java\n    for (int i = 0; i \u003c end; i++)\n    {\n        char c = encodedPath.charAt(i);\n\n        switch (c)\n        {\n            case ';':\n                if (builder == null)\n                {\n                    builder = new Utf8StringBuilder(encodedPath.length());\n                    builder.append(encodedPath, 0, i);\n                }\n\n                while (++i \u003c end)\n                {\n                    if (encodedPath.charAt(i) == '/')\n                    {\n                        builder.append('/');\n                        break;\n                    }\n                }\n                break;\n\n            case '.':\n                if (slash)\n                    normal = false;\n                if (builder != null)\n                    builder.append(c);\n                break;\n        }\n\n        slash = c == '/';\n    }\n\n    String canonical = (builder != null)\n        ? (onBadUtf8 == null ? builder.toCompleteString() : builder.takeCompleteString(onBadUtf8))\n        : encodedPath;\n    return normal ? canonical : normalizePath(canonical);\n```\n\nFor the input:\n\n`/public;/../admin/secret`\n\nwhen the outer loop reaches the semicolon:\n\n```\n    i      = 7\n    c      = ';'\n    slash  = false\n    normal = true\n```\n\nInside `case ';'`, the `while (++i \u003c end)` loop advances i to the next character, which is already '/' for the empty path parameter form \";/\".\n\nThe code then appends '/' to the canonical builder:\n\n`builder.append('/');`\n\nAt this point, the canonical builder ends with '/':\n\n`/public/`\n\nHowever, the local variable `c` is still the old value ';', because `c` was read before entering the switch and is not updated when the inner loop advances `i`.\n\nAfter leaving the switch, the loop updates the slash state using:\n\n`slash = c == '/';`\n\nSince `c` is still ';', slash becomes `false`.\n\nOn the next iteration, the scanner reaches '.', which is the first dot in the following \"../\" segment. Because slash is incorrectly `false`, this code does not run:\n\n```java\n    if (slash)\n        normal = false;\n```\n\nTherefore `normal` remains `true`, and `canonicalPath()` returns the canonical string directly instead of calling `normalizePath(canonical)`.\n\nThe result is:\n\n`/public/../admin/secret`\n\ninstead of:\n\n`/admin/secret`\n\nIn short:\n\n`case ';'` advances the scan position i and appends '/' to the canonical builder, but the loop tail still updates slash from the stale character `c=';'`. As a result, the following dot-dot segment is not detected as a path traversal segment.\n\n####  More Precise Trigger Condition\n\nThe issue is not limited to a non-empty path parameter such as \";x\".\n\nThe more precise trigger shape is:\n\n`;[^/]*/.`\n\nExamples:\n\n```\n    /public;/../admin/secret\n    /public;x/../admin/secret\n    /public;anything/../admin/secret\n    /public;/./admin/secret\n```\n\nThe minimal form is:\n\n`/public;/../admin/secret`\n\nbecause the semicolon is immediately followed by '/', so the inner while loop reaches '/' on its first increment.\n\n####  Potential Minimal Fix Direction\n\nA minimal fix would be to ensure that, when case ';' consumes input until '/' and appends '/' to the canonical builder, the slash state reflects the last effective character in the canonical path.\n\nFor example, conceptually:\n\n```java\n    case ';':\n        if (builder == null)\n        {\n            builder = new Utf8StringBuilder(encodedPath.length());\n            builder.append(encodedPath, 0, i);\n        }\n\n        while (++i \u003c end)\n        {\n            if (encodedPath.charAt(i) == '/')\n            {\n                builder.append('/');\n                slash = true;\n                break;\n            }\n        }\n        continue;\n```\n\nThe important part is to avoid the loop tail from overwriting slash using the stale `c` value:\n\n`slash = c == '/';`\n\nIn other words, `slash` should represent the last effective character appended to the canonical builder, not the original input character read before case ';' advanced `i`.","status":"published","published":"2026-07-22T22:57:36Z","modified":"2026-09-10T03:51:12.48586289Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"cwes":["CWE-647"],"updated_at":"2026-11-02T15:46:58.401149Z"},{"id":"UBUNTU-CVE-2026-8384","description":"In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.","status":"published","published":"2026-07-14T09:16:00Z","modified":"2026-10-17T13:01:12.325882356Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:57:22.213888Z"}]}}