CVE-2026-76182

Overview

Eclipse Jetty is a widely used, embeddable Java web server and servlet container. It supports HTTP/1.1, HTTP/2, HTTP/3, and WebSocket, and is commonly deployed both as a standalone server and embedded within Java application runtimes and frameworks. Its FastCGI modules let Jetty front FastCGI applications such as PHP, and provide a try-files filter (TryFilesFilter) that serves an existing file or forwards the request to a configured fallback URI; in Jetty 12, the core jetty-server module's TryPathsHandler provides the same behavior.

A resource injection vulnerability (CVE-2026-76182) has been identified in the Eclipse Jetty try-files fallback handling, which allows attackers to add arbitrary query parameters to the request forwarded to the fallback application. Any further impact depends on whether the downstream application trusts the injected parameter for a sensitive decision such as routing, object selection, tenant selection, or authorization.

Per OWASP: This attack consists of changing resource identifiers used by an application in order to perform a malicious task. When an application defines a resource type or location based on user input, such as a file name or port number, this data can be manipulated to execute or access different resources.

This issue affects multiple versions of Eclipse Jetty.

Details

Module Info

• Product: Eclipse Jetty
• Affected packages: org.eclipse.jetty.fcgi:fcgi-server, org.eclipse.jetty:jetty-server, org.eclipse.jetty.ee8:jetty-ee8-fcgi-proxy, org.eclipse.jetty.ee9:jetty-ee9-fcgi-proxy, org.eclipse.jetty.ee10:jetty-ee10-fcgi-proxy, org.eclipse.jetty.ee11:jetty-ee11-fcgi-proxy
• Affected versions:
  • org.eclipse.jetty.fcgi:fcgi-server: >=9.4.0 <=9.4.64, >=10.0.0 <=10.0.32, >=11.0.0 <=11.0.32
  • org.eclipse.jetty:jetty-server: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.12
  • org.eclipse.jetty.ee8:jetty-ee8-fcgi-proxy: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.12
  • org.eclipse.jetty.ee9:jetty-ee9-fcgi-proxy: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.12
  • org.eclipse.jetty.ee10:jetty-ee10-fcgi-proxy: >=12.0.0 <=12.0.38, >=12.1.0 <=12.1.12
  • org.eclipse.jetty.ee11:jetty-ee11-fcgi-proxy: >=12.1.0 <=12.1.12
• GitHub repository: https://github.com/jetty/jetty.project
• Published packages:
  • https://central.sonatype.com/artifact/org.eclipse.jetty.fcgi/fcgi-server
  • https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-server
  • https://central.sonatype.com/artifact/org.eclipse.jetty.ee8/jetty-ee8-fcgi-proxy
  • https://central.sonatype.com/artifact/org.eclipse.jetty.ee9/jetty-ee9-fcgi-proxy
  • https://central.sonatype.com/artifact/org.eclipse.jetty.ee10/jetty-ee10-fcgi-proxy
  • https://central.sonatype.com/artifact/org.eclipse.jetty.ee11/jetty-ee11-fcgi-proxy
• Package manager: Maven
• Fixed in:
  • OSS Eclipse Jetty 12.0.39, 12.1.13
  • NES for Jetty v9.4.65, v10.0.33, v11.0.33

Vulnerability Info

This Medium-severity vulnerability is found in the org.eclipse.jetty.fcgi:fcgi-server package in Jetty 9.4.x, 10.0.x and 11.0.x, and in the org.eclipse.jetty:jetty-server and jetty-ee*-fcgi-proxy packages in Jetty 12.0.x and 12.1.x, of Eclipse Jetty.

TryFilesFilter is configured with a space-separated list of file URIs in its files init-param, for example /maintenance.html $path /index.php?p=$path. The special token $path stands for the request path after the context path. When none of the earlier entries resolves to a readable file, the last entry is used as the fallback, and the request is forwarded to it after $path has been substituted:

protected void fallback(HttpServletRequest request, HttpServletResponse response, FilterChain chain, String fallback) throws IOException, ServletException
{
    String resolved = resolve(request, fallback);
    request.getServletContext().getRequestDispatcher(resolved).forward(request, response);
}

private String resolve(HttpServletRequest request, String value)
{
    String path = request.getServletPath();
    String info = request.getPathInfo();
    if (info != null)
        path += info;
    if (!path.startsWith("/"))
        path = "/" + path;
    return StringUtil.replace(value, "$path", path);
}

The servlet path and path info are already percent-decoded, and resolve() inserts them into the fallback URI with a plain string replacement. When $path appears in the query part of the fallback, characters that are only data in the path become query syntax. A request for /article%26role=admin decodes to /article&role=admin, so the fallback /index.php?p=$path becomes /index.php?p=/article&role=admin. The fallback application then receives two parameters, p=/article and an attacker-chosen role=admin, instead of one p value. The same unencoded substitution exists in TryPathsHandler.interpolate() in Jetty 12, which replaces $path with Request.getPathInContext(request) before splitting the result at the first ? and installing the remainder as the rewritten query. No authentication is required; the only precondition is a try-files configuration that places $path in the fallback query string.

Mitigation

Only recent versions of Eclipse Jetty are community-supported. Only community-supported versions will receive updates to address this issue. As of January 1, 2026 the Jetty project and Webtide no longer publish Jetty 9, Jetty 10, or Jetty 11 releases to Maven Central; see the project's End-of-Life announcement.

Users of the affected components should apply one of the following mitigations:

• Upgrade affected applications to a supported version of Eclipse Jetty (12.0.39 or 12.1.13).
• Leverage a commercial support partner like HeroDevs for post-EOL security support.

Credits

• 4ra1n (finder)
• unam4 (finder)
• pyn3rd (finder)