Jackrabbit WebDAV Surfaces: 2,254 Body Matches Against 237 Titles

Apache Jackrabbit fixed two flaws on 2026-10-07, including a WebDAV session hijack rated 9.3 and an unsafe reflection issue in the DavEx client rated 6.9. The repository is embedded in content management platforms, so its WebDAV endpoint is not always an obvious internet service. The fingerprint question here is whether the response body carries the product marker or only the page title.

The measurements

ZoomEye queries executed on 2026-10-09 between 02:50 and 02:52 UTC, sub_type all, global index:
| Query | Matching assets |
| --- | ---: |
| http.body="Jackrabbit" | 2,254 |
| title="Jackrabbit" | 237 |
The body query returns roughly nine times the title query. That gap is the useful part of the measurement. A title match means the string appears in a page title, which is what a login or administration page would show. A body match means the marker appears anywhere in the response, which is typical for repository endpoints that return XML or JSON. The counts are best read with the unit in view: they are fingerprint matches, not confirmed deployments of an affected version.

Why the gap matters for this flaw

CVE-2026-92414 is about session attachment inside the WebDAV server, and CVE-2026-92415 is about the DavEx client reading server-controlled error bodies. Both live in code paths that exist to serve remote content, which is the code that produces body matches rather than decorative page titles.

What to do

Inventory applications that embed Jackrabbit, then check which of them publish a WebDAV endpoint beyond the internal network. Upgrade to 2.23.6, 2.22.5 or 2.20.18 depending on the maintained branch.

Method notes and limits

The counts are fingerprint matches without version detail, so they estimate discoverability rather than the vulnerable population. Both queries used the same scope setting in the same session. No asset records were reviewed case by case.

References

ZoomEye, cyberspace search: https://www.zoomeye.ai
Apache Jackrabbit fixes a critical WebDAV session hijack flaw: https://securityonline.info/apache-jackrabbit-vulnerabilities/