Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-76182

Quick assessment

Affected
Eclipse Foundation Eclipse Jetty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

在 Eclipse Jetty 中， 和 可被配置为将请求转发至包含模板 URI 的资源，例如 ，其中 表示请求在上下文中的路径。 然而，URI 路径中可能包含在 URI 查询部分具有特殊意义的保留字符。因此，当路径为 时，应用模板后会生成 ，这被解析为两个查询参数： 和 ，而不是只有一个查询参数 ，其值为 。

CVSS 6.9 · Medium EPSS 0.27% · P18

Possible ATT&CK Techniques 1 AI

T1190 · Exploit Public-Facing Application

Affected Version Matrix 12

VendorProduct Version RangeStatus
Eclipse Foundation Eclipse Jetty 12.1.0≤ 12.1.12 affected
12.0.0≤ 12.0.38 affected
12.1.0≤ 12.1.12 affected
12.1.0≤ 12.1.12 affected
12.0.0≤ 12.0.38 affected
12.1.0≤ 12.1.12 affected
12.0.0≤ 12.0.38 affected
11.0.0≤ 11.0.32 affected
… +4 more rows
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-76182

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context. However, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
输出中的特殊元素转义处理不恰当(注入)
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
Eclipse Foundation Eclipse Jetty 12.1.0 ~ 12.1.12 -
Eclipse Foundation Eclipse Jetty 12.1.0 ~ 12.1.12 -
Eclipse Foundation Eclipse Jetty 12.1.0 ~ 12.1.12 -
Eclipse Foundation Eclipse Jetty 12.1.0 ~ 12.1.12 -
Eclipse Foundation Eclipse Jetty 11.0.0 ~ 11.0.32 -
Eclipse Foundation Eclipse Jetty 12.1.0 ~ 12.1.12 -

II. Public POCs for CVE-2026-76182

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-76182

请登录查看更多情报信息。

Other References for CVE-2026-76182 (2)

Same Patch Batch · Eclipse Foundation · 2026-10-15 · 25 CVEs total

CVE-2026-19863 9.3 CRITICAL EthereumAuthenticator未授权访问漏洞
CVE-2026-102469 9.2 CRITICAL CVE-2026-102469
CVE-2026-18660 8.8 HIGH Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames
CVE-2026-18661 8.8 HIGH Eclipse Jetty 多个版本 Jakarta安全约束绕过漏洞
CVE-2026-102467 8.7 HIGH Vert.x 4.0.0-5.2.0空字节限制致DDoS
CVE-2026-102475 8.7 HIGH Eclipse Vert.x 5.x HTTP代理内存溢出漏洞
CVE-2026-102461 8.7 HIGH Eclipse Vert.x DoS漏洞：JSON Schema验证算法缺陷
CVE-2026-102477 8.7 HIGH Vert.x gRPC-server配置压缩限制绕过致压缩炸弹攻击
CVE-2026-76184 8.2 HIGH Eclipse Jetty HttpClient重定向认证头泄露漏洞
CVE-2026-77711 8.2 HIGH Jetty HttpClient代理凭据泄露漏洞
CVE-2026-102465 8.2 HIGH Vert.x MySQL Client越界数组分配致OOM漏洞
CVE-2026-103224 8.2 HIGH Vert.x MySQL客户端多个版本存在OOM漏洞
CVE-2026-103223 8.2 HIGH Eclipse Vert.x 4-5 PostgreSQL客户端缓冲区溢出致OOM
CVE-2026-102463 8.2 HIGH Eclipse Vertx多版本vertx-pg-client数组解码内存耗尽漏洞
CVE-2026-102464 8.2 HIGH Eclipse Vert.x MQTT未受限存储致OOM
CVE-2026-102466 8.2 HIGH Eclipse Vert.x MySQL客户端拒绝服务漏洞
CVE-2026-102462 8.2 HIGH Vert.x MSSQL Client多个版本OOM漏洞
CVE-2026-18662 6.9 MEDIUM Jetty安全组件URL模式为空时约束冲突漏洞
CVE-2026-18659 6.9 MEDIUM Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission m
CVE-2026-19864 5.6 MEDIUM Eclipse Jetty会话认证凭据明文存储漏洞

Showing top 20 of 25 CVEs. View all on vendor page → →

IV. Related Vulnerabilities

Same product: Eclipse Jetty
Same vendor: Eclipse Foundation
Same weakness: CWE-74

V. Comments for CVE-2026-76182

No comments yet

Leave a comment