What is CVE-2026-8384?

CVE-2026-8384 is a medium-severity vulnerability in Eclipse Jetty, classified under CWE-647. CVSS score: 5.3/10. Published 2026-07-14.

How severe is CVE-2026-8384?

Medium severity. CVSS v3 base score is 5.3 out of 10.

Vulnerability in Eclipse Jetty

CVE-2026-8384

In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

EPSS: 0.003 (25.5th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 5.3 (Medium). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N.

Affected products

Eclipse Jetty
Eclipse Foundation Jetty — versions 12.0.0, 12.1.0

Weakness classification (CWE)

CWE-647

References

emo@eclipse.org (Exploit, Vendor Advisory)

Frequently asked questions

What is CVE-2026-8384?: CVE-2026-8384 is a medium-severity vulnerability in Eclipse Jetty, classified under CWE-647. CVSS score: 5.3/10. Published 2026-07-14.
How severe is CVE-2026-8384?: Medium severity. CVSS v3 base score is 5.3 out of 10.