CVE-2026-8384: CVE-2026-8384: URI Path Parameter Parser State-Desynchronization Path Traversal in Eclipse Jetty

CVE-2026-8384: URI Path Parameter Parser State-Desynchronization Path Traversal in Eclipse Jetty

Vulnerability ID: CVE-2026-8384
CVSS Score: 5.3
Published: 2026-07-22

A path traversal vulnerability exists in Eclipse Jetty due to a state-desynchronization defect in the URI parsing state machine inside URIUtil.java. This defect allows unauthenticated remote attackers to bypass path-based security constraints enforced by downstream filters, application gateways, or authorization modules by crafting URIs with path parameter delimiters and parent directory traversal sequences.

TL;DR

Eclipse Jetty suffers from a path traversal vulnerability where state desynchronization in the URI parsing code allows unnormalized paths containing directory traversal sequences (such as '/public;/../admin') to be forwarded to downstream security components, leading to authentication and authorization bypasses.

---

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-647 (Improper Neutralization of Sanitization-Related Special Elements)
• Attack Vector: Network
• CVSS v3.1 Score: 5.3 (Medium)
• EPSS Score: 0.00198
• Exploit Status: poc
• CISA KEV Status: Not Listed

Affected Systems

• Eclipse Jetty 12.0.0 through 12.0.34
• Eclipse Jetty 12.1.0 through 12.1.8
• Eclipse Jetty: >= 12.0.0, <= 12.0.34 (Fixed in: 12.0.35)
• Eclipse Jetty: >= 12.1.0, <= 12.1.8 (Fixed in: 12.1.9)

Code Analysis

Commit: ade27ce

Fix state desynchronization in URIUtil.canonicalPath by updating char variable inside inner matrix parameter loops

Commit: 82969c7

Address decodePath parsing state mismatch during semicolon parsing

Exploit Details

• GitHub Security Advisory: Official advisory containing reproduction details for the URI path desynchronization issue.

Mitigation Strategies

• Upgrade Eclipse Jetty server instances to patched releases (12.0.35+ or 12.1.9+).
• Deploy upstream URI normalization policies on load balancers, reverse proxies, and API gateways.
• Configure WAF rules to detect and drop HTTP requests containing semicolons paired with relative directory traversal segments.

Remediation Steps:

1. Identify all internal deployments and dependencies using Eclipse Jetty 12.0.x and 12.1.x.
2. For Jetty 12.0 deployments, upgrade the runtime and library dependencies to version 12.0.35.
3. For Jetty 12.1 deployments, upgrade the runtime and library dependencies to version 12.1.9.
4. Implement an intermediate NGINX or HAProxy rule to block request paths containing semicolons if immediate upgrade is not possible.
5. Restart the application server and verify URI resolution using testing endpoints.

References

• GitHub Advisory: GHSA-w7x5-g22v-xqhr
• Eclipse Security CVE Assignment Issue 108
• Eclipse Jetty Release 12.0.35
• Eclipse Jetty Release 12.1.9

---

Read the full report for CVE-2026-8384 on our website for more details including interactive diagrams and full exploit analysis.