CVE-2021-28164 — AI Deep Analysis Summary

Q: Who is affected? (Versions/Components)

📦 **Product**: Eclipse Jetty (Java Web Server/Servlet Container). 📅 **Affected Versions**: 9.4.37.v20210219 **through** 9.4.38.v20210224. 🏢 **Vendor**: The Eclipse Foundation.

Q: Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: LOW. 🌐 **Network**: Remote (AV:N). 🔑 **Auth**: None needed (PR:N). 🖱️ **User Interaction**: None (UI:N). 📉 **Complexity**: Low (AC:L). Simply sending a crafted HTTP request is enough.

Q: Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exploits**: YES. 📂 **PoCs Available**: Multiple GitHub repos (e.g., `vulhub`, `nuclei-templates`, `jammy0903`). 🚀 **Status**: Easy to reproduce and automate using standard scanning tools.

Q: Is it fixed officially? (Patch/Mitigation)

🛡️ **Official Fix**: YES. 📦 **Solution**: Upgrade to Eclipse Jetty version **9.4.39.v20210325** or later. 🔒 **Action**: Apply the vendor patch immediately to close the URI parsing loophole.

Updated May 06, 2026 CVSS 5.3 · Medium

This is a summary of the AI-generated 10-question deep analysis. The full version (longer answers, follow-up Q&A, related CVEs) requires login. Read the full analysis →

Q1What is this vulnerability? (Essence + Consequences)

🚨 **Essence**: Eclipse Jetty fails to properly sanitize URIs containing `%2e` or `%2e%2e`. 📉 **Consequences**: Attackers bypass security controls to access `WEB-INF` protected resources.…

Read full answer (login)

Q2Root Cause? (CWE/Flaw)

🛡️ **CWE**: CWE-200 (Information Exposure).…

Read full answer (login)

Q3Who is affected? (Versions/Components)

📦 **Product**: Eclipse Jetty (Java Web Server/Servlet Container). 📅 **Affected Versions**: 9.4.37.v20210219 **through** 9.4.38.v20210224. 🏢 **Vendor**: The Eclipse Foundation.

Q4What can hackers do? (Privileges/Data)

🕵️ **Privileges**: No authentication required (PR:N). 📂 **Data Access**: Can read files inside `WEB-INF/` (e.g., `web.xml`, classes, properties).…

Read full answer (login)

Q5Is exploitation threshold high? (Auth/Config)

⚡ **Threshold**: LOW. 🌐 **Network**: Remote (AV:N). 🔑 **Auth**: None needed (PR:N). 🖱️ **User Interaction**: None (UI:N). 📉 **Complexity**: Low (AC:L). Simply sending a crafted HTTP request is enough.

Q6Is there a public Exp? (PoC/Wild Exploitation)

🔓 **Public Exploits**: YES. 📂 **PoCs Available**: Multiple GitHub repos (e.g., `vulhub`, `nuclei-templates`, `jammy0903`). 🚀 **Status**: Easy to reproduce and automate using standard scanning tools.

Q7How to self-check? (Features/Scanning)

🔍 **Check Method**: Send requests with URIs like `/WEB-INF/web.xml` using `%2e` or `%2e%2e` encoding.…

Read full answer (login)

Q8Is it fixed officially? (Patch/Mitigation)

🛡️ **Official Fix**: YES. 📦 **Solution**: Upgrade to Eclipse Jetty version **9.4.39.v20210325** or later. 🔒 **Action**: Apply the vendor patch immediately to close the URI parsing loophole.

Q9What if no patch? (Workaround)

🚧 **No Patch Workaround**: 1. Configure a Web Application Firewall (WAF) to block URIs containing `%2e` or `%2e%2e`. 2.…

Read full answer (login)

Q10Is it urgent? (Priority Suggestion)

⚠️ **Priority**: HIGH. 🚨 **Urgency**: Critical for Java-based web apps. 📉 **Risk**: CVSS 3.1 (Low severity score, but High impact due to ease of exploitation and lack of auth).…

Read full answer (login)

Continue exploring

Vulnerability detail Full AI analysis (login) The Eclipse Foundation CWE-200