{"document":{"aggregate_severity":{"namespace":"https://access.redhat.com/security/updates/classification/","text":"Moderate"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright © Red Hat, Inc. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"legal_disclaimer","text":"This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.","title":"Terms of Use"}],"publisher":{"category":"vendor","contact_details":"https://access.redhat.com/security/team/contact/","issuing_authority":"Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.","name":"Red Hat Product Security","namespace":"https://www.redhat.com"},"references":[{"category":"self","summary":"Canonical URL","url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-8384.json"}],"title":"jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications","tracking":{"current_release_date":"2026-08-05T13:50:48+00:00","generator":{"date":"2026-08-05T13:50:48+00:00","engine":{"name":"Red Hat SDEngine","version":"5.3.12"}},"id":"CVE-2026-8384","initial_release_date":"2026-07-14T08:56:17.525000+00:00","revision_history":[{"date":"2026-07-14T08:56:17.525000+00:00","number":"1","summary":"Initial version"},{"date":"2026-08-05T13:43:56+00:00","number":"2","summary":"Current version"},{"date":"2026-08-05T13:50:48+00:00","number":"3","summary":"Last generated version"}],"status":"final","version":"3"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"OpenShift Developer Tools and Services","product":{"name":"OpenShift Developer Tools and Services","product_id":"openshift_developer_tools_and_services","product_identification_helper":{"cpe":"cpe:/a:redhat:ocp_tools"}}}],"category":"product_family","name":"OpenShift Developer Tools and Services"},{"branches":[{"category":"product_name","name":"Red Hat AMQ Broker 7","product":{"name":"Red Hat AMQ Broker 7","product_id":"red_hat_amq_broker_7","product_identification_helper":{"cpe":"cpe:/a:redhat:amq_broker:7"}}}],"category":"product_family","name":"Red Hat AMQ Broker 7"},{"branches":[{"category":"product_name","name":"Red Hat build of Apache Camel 4 for Quarkus 3","product":{"name":"Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3","product_identification_helper":{"cpe":"cpe:/a:redhat:camel_quarkus:3"}}}],"category":"product_family","name":"Red Hat build of Apache Camel 4 for Quarkus 3"},{"branches":[{"category":"product_name","name":"Red Hat build of Apache Camel for Spring Boot 4","product":{"name":"Red Hat build of Apache Camel for Spring Boot 4","product_id":"red_hat_build_of_apache_camel_for_spring_boot_4","product_identification_helper":{"cpe":"cpe:/a:redhat:camel_spring_boot:4"}}}],"category":"product_family","name":"Red Hat build of Apache Camel for Spring Boot 4"},{"branches":[{"category":"product_name","name":"Red Hat build of Apache Camel - HawtIO 4","product":{"name":"Red Hat build of Apache Camel - HawtIO 4","product_id":"red_hat_build_of_apache_camel_-_hawtio_4","product_identification_helper":{"cpe":"cpe:/a:redhat:apache_camel_hawtio:4"}}}],"category":"product_family","name":"Red Hat build of Apache Camel - HawtIO 4"},{"branches":[{"category":"product_name","name":"Red Hat build of Apicurio Registry 3","product":{"name":"Red Hat build of Apicurio Registry 3","product_id":"red_hat_build_of_apicurio_registry_3","product_identification_helper":{"cpe":"cpe:/a:redhat:apicurio_registry:3"}}}],"category":"product_family","name":"Red Hat build of Apicurio Registry 3"},{"branches":[{"category":"product_name","name":"Red Hat build of Debezium 3","product":{"name":"Red Hat build of Debezium 3","product_id":"red_hat_build_of_debezium_3","product_identification_helper":{"cpe":"cpe:/a:redhat:debezium:3"}}}],"category":"product_family","name":"Red Hat build of Debezium 3"},{"branches":[{"category":"product_name","name":"Red Hat Data Grid 8","product":{"name":"Red Hat Data Grid 8","product_id":"red_hat_data_grid_8","product_identification_helper":{"cpe":"cpe:/a:redhat:jboss_data_grid:8"}}}],"category":"product_family","name":"Red Hat Data Grid 8"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 6","product":{"name":"Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:6"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 6"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 7","product":{"name":"Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:7"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 7"},{"branches":[{"category":"product_name","name":"Red Hat Enterprise Linux 9","product":{"name":"Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9","product_identification_helper":{"cpe":"cpe:/o:redhat:enterprise_linux:9"}}}],"category":"product_family","name":"Red Hat Enterprise Linux 9"},{"branches":[{"category":"product_name","name":"Red Hat JBoss Enterprise Application Platform Expansion Pack","product":{"name":"Red Hat JBoss Enterprise Application Platform Expansion Pack","product_id":"red_hat_jboss_enterprise_application_platform_expansion_pack","product_identification_helper":{"cpe":"cpe:/a:redhat:jbosseapxp"}}}],"category":"product_family","name":"Red Hat JBoss Enterprise Application Platform Expansion Pack"},{"branches":[{"category":"product_name","name":"Red Hat Offline Knowledge Portal","product":{"name":"Red Hat Offline Knowledge Portal","product_id":"red_hat_offline_knowledge_portal","product_identification_helper":{"cpe":"cpe:/a:redhat:offline_knowledge_portal:1"}}}],"category":"product_family","name":"Red Hat Offline Knowledge Portal"},{"branches":[{"category":"product_name","name":"Red Hat OpenShift AI (RHOAI)","product":{"name":"Red Hat OpenShift AI (RHOAI)","product_id":"red_hat_openshift_ai_(rhoai)","product_identification_helper":{"cpe":"cpe:/a:redhat:openshift_ai"}}}],"category":"product_family","name":"Red Hat OpenShift AI (RHOAI)"},{"branches":[{"category":"product_name","name":"Red Hat OpenShift Dev Spaces","product":{"name":"Red Hat OpenShift Dev Spaces","product_id":"red_hat_openshift_dev_spaces","product_identification_helper":{"cpe":"cpe:/a:redhat:openshift_devspaces:3"}}}],"category":"product_family","name":"Red Hat OpenShift Dev Spaces"},{"branches":[{"category":"product_name","name":"Red Hat Satellite 6","product":{"name":"Red Hat Satellite 6","product_id":"red_hat_satellite_6","product_identification_helper":{"cpe":"cpe:/a:redhat:satellite:6"}}}],"category":"product_family","name":"Red Hat Satellite 6"},{"branches":[{"category":"product_name","name":"Red Hat Single Sign-On 7","product":{"name":"Red Hat Single Sign-On 7","product_id":"red_hat_single_sign-on_7","product_identification_helper":{"cpe":"cpe:/a:redhat:red_hat_single_sign_on:7"}}}],"category":"product_family","name":"Red Hat Single Sign-On 7"},{"branches":[{"category":"product_name","name":"streams for Apache Kafka 2","product":{"name":"streams for Apache Kafka 2","product_id":"streams_for_apache_kafka_2","product_identification_helper":{"cpe":"cpe:/a:redhat:amq_streams:2"}}}],"category":"product_family","name":"streams for Apache Kafka 2"},{"branches":[{"category":"product_name","name":"streams for Apache Kafka 3","product":{"name":"streams for Apache Kafka 3","product_id":"streams_for_apache_kafka_3","product_identification_helper":{"cpe":"cpe:/a:redhat:amq_streams:3"}}}],"category":"product_family","name":"streams for Apache Kafka 3"},{"category":"product_version","name":"jenkins.src","product":{"name":"jenkins.src","product_id":"jenkins.src","product_identification_helper":{"purl":"pkg:rpm/redhat/jenkins?arch=src"}}},{"category":"product_version","name":"ocp-tools-4/jenkins-rhel8","product":{"name":"ocp-tools-4/jenkins-rhel8","product_id":"ocp-tools-4/jenkins-rhel8","product_identification_helper":{"purl":"pkg:oci/jenkins-rhel8?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel8"}}},{"category":"product_version","name":"ocp-tools-4/jenkins-rhel9","product":{"name":"ocp-tools-4/jenkins-rhel9","product_id":"ocp-tools-4/jenkins-rhel9","product_identification_helper":{"purl":"pkg:oci/jenkins-rhel9?repository_url=registry.redhat.io/ocp-tools-4/jenkins-rhel9"}}},{"category":"product_version","name":"jetty-util","product":{"name":"jetty-util","product_id":"jetty-util","product_identification_helper":{"purl":"pkg:maven/org.eclipse.jetty/jetty-util"}}},{"category":"product_version","name":"jetty-eclipse.src","product":{"name":"jetty-eclipse.src","product_id":"jetty-eclipse.src","product_identification_helper":{"purl":"pkg:rpm/redhat/jetty-eclipse?arch=src"}}},{"category":"product_version","name":"jetty-eclipse","product":{"name":"jetty-eclipse","product_id":"jetty-eclipse","product_identification_helper":{"purl":"pkg:rpm/redhat/jetty-eclipse"}}},{"category":"product_version","name":"maven-site-plugin-javadoc","product":{"name":"maven-site-plugin-javadoc","product_id":"maven-site-plugin-javadoc","product_identification_helper":{"purl":"pkg:rpm/redhat/maven-site-plugin-javadoc"}}},{"category":"product_version","name":"maven-site-plugin.src","product":{"name":"maven-site-plugin.src","product_id":"maven-site-plugin.src","product_identification_helper":{"purl":"pkg:rpm/redhat/maven-site-plugin?arch=src"}}},{"category":"product_version","name":"jmc.src","product":{"name":"jmc.src","product_id":"jmc.src","product_identification_helper":{"purl":"pkg:rpm/redhat/jmc?arch=src"}}},{"category":"product_version","name":"jmc","product":{"name":"jmc","product_id":"jmc","product_identification_helper":{"purl":"pkg:rpm/redhat/jmc"}}},{"category":"product_version","name":"offline-knowledge-portal/rhokp-rhel9","product":{"name":"offline-knowledge-portal/rhokp-rhel9","product_id":"offline-knowledge-portal/rhokp-rhel9","product_identification_helper":{"purl":"pkg:oci/rhokp-rhel9?repository_url=registry.redhat.io/offline-knowledge-portal/rhokp-rhel9"}}},{"category":"product_version","name":"rhoai/odh-spark-operator-rhel9","product":{"name":"rhoai/odh-spark-operator-rhel9","product_id":"rhoai/odh-spark-operator-rhel9","product_identification_helper":{"purl":"pkg:oci/odh-spark-operator-rhel9?repository_url=registry.redhat.io/rhoai/odh-spark-operator-rhel9"}}},{"category":"product_version","name":"rhoai/odh-th06-cpu-torch210-py312-rhel9","product":{"name":"rhoai/odh-th06-cpu-torch210-py312-rhel9","product_id":"rhoai/odh-th06-cpu-torch210-py312-rhel9","product_identification_helper":{"purl":"pkg:oci/odh-th06-cpu-torch210-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch210-py312-rhel9"}}},{"category":"product_version","name":"rhoai/odh-th06-cpu-torch291-py312-rhel9","product":{"name":"rhoai/odh-th06-cpu-torch291-py312-rhel9","product_id":"rhoai/odh-th06-cpu-torch291-py312-rhel9","product_identification_helper":{"purl":"pkg:oci/odh-th06-cpu-torch291-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cpu-torch291-py312-rhel9"}}},{"category":"product_version","name":"rhoai/odh-th06-cuda130-torch210-py312-rhel9","product":{"name":"rhoai/odh-th06-cuda130-torch210-py312-rhel9","product_id":"rhoai/odh-th06-cuda130-torch210-py312-rhel9","product_identification_helper":{"purl":"pkg:oci/odh-th06-cuda130-torch210-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch210-py312-rhel9"}}},{"category":"product_version","name":"rhoai/odh-th06-cuda130-torch291-py312-rhel9","product":{"name":"rhoai/odh-th06-cuda130-torch291-py312-rhel9","product_id":"rhoai/odh-th06-cuda130-torch291-py312-rhel9","product_identification_helper":{"purl":"pkg:oci/odh-th06-cuda130-torch291-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-cuda130-torch291-py312-rhel9"}}},{"category":"product_version","name":"rhoai/odh-th06-rocm64-torch291-py312-rhel9","product":{"name":"rhoai/odh-th06-rocm64-torch291-py312-rhel9","product_id":"rhoai/odh-th06-rocm64-torch291-py312-rhel9","product_identification_helper":{"purl":"pkg:oci/odh-th06-rocm64-torch291-py312-rhel9?repository_url=registry.redhat.io/rhoai/odh-th06-rocm64-torch291-py312-rhel9"}}},{"category":"product_version","name":"devspaces/openvsx-rhel9","product":{"name":"devspaces/openvsx-rhel9","product_id":"devspaces/openvsx-rhel9","product_identification_helper":{"purl":"pkg:oci/openvsx-rhel9?repository_url=registry.redhat.io/devspaces/openvsx-rhel9"}}},{"category":"product_version","name":"devspaces/pluginregistry-rhel9","product":{"name":"devspaces/pluginregistry-rhel9","product_id":"devspaces/pluginregistry-rhel9","product_identification_helper":{"purl":"pkg:oci/pluginregistry-rhel9?repository_url=registry.redhat.io/devspaces/pluginregistry-rhel9"}}},{"category":"product_version","name":"openvox-server.src","product":{"name":"openvox-server.src","product_id":"openvox-server.src","product_identification_helper":{"purl":"pkg:rpm/redhat/openvox-server?arch=src"}}},{"category":"product_version","name":"puppetserver.src","product":{"name":"puppetserver.src","product_id":"puppetserver.src","product_identification_helper":{"purl":"pkg:rpm/redhat/puppetserver?arch=src"}}},{"category":"product_version","name":"puppetserver","product":{"name":"puppetserver","product_id":"puppetserver","product_identification_helper":{"purl":"pkg:rpm/redhat/puppetserver"}}},{"category":"product_version","name":"puppetserver.src::satellite-capsule:el8","product":{"name":"puppetserver.src (satellite-capsule:el8)","product_id":"puppetserver.src::satellite-capsule:el8","product_identification_helper":{"purl":"pkg:rpm/redhat/puppetserver?arch=src&rpmmod=satellite-capsule:el8"}}},{"category":"product_version","name":"puppetserver::satellite-capsule:el8","product":{"name":"puppetserver (satellite-capsule:el8)","product_id":"puppetserver::satellite-capsule:el8","product_identification_helper":{"purl":"pkg:rpm/redhat/puppetserver?rpmmod=satellite-capsule:el8"}}}],"category":"vendor","name":"Red Hat"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"jenkins.src as a component of OpenShift Developer Tools and Services","product_id":"openshift_developer_tools_and_services:jenkins.src"},"product_reference":"jenkins.src","relates_to_product_reference":"openshift_developer_tools_and_services"},{"category":"default_component_of","full_product_name":{"name":"ocp-tools-4/jenkins-rhel8 as a component of OpenShift Developer Tools and Services","product_id":"openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8"},"product_reference":"ocp-tools-4/jenkins-rhel8","relates_to_product_reference":"openshift_developer_tools_and_services"},{"category":"default_component_of","full_product_name":{"name":"ocp-tools-4/jenkins-rhel9 as a component of OpenShift Developer Tools and Services","product_id":"openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9"},"product_reference":"ocp-tools-4/jenkins-rhel9","relates_to_product_reference":"openshift_developer_tools_and_services"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of Red Hat AMQ Broker 7","product_id":"red_hat_amq_broker_7:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"red_hat_amq_broker_7"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of Red Hat build of Apache Camel - HawtIO 4","product_id":"red_hat_build_of_apache_camel_-_hawtio_4:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"red_hat_build_of_apache_camel_-_hawtio_4"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of Red Hat build of Apache Camel 4 for Quarkus 3","product_id":"red_hat_build_of_apache_camel_4_for_quarkus_3:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"red_hat_build_of_apache_camel_4_for_quarkus_3"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of Red Hat build of Apache Camel for Spring Boot 4","product_id":"red_hat_build_of_apache_camel_for_spring_boot_4:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"red_hat_build_of_apache_camel_for_spring_boot_4"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of Red Hat build of Apicurio Registry 3","product_id":"red_hat_build_of_apicurio_registry_3:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"red_hat_build_of_apicurio_registry_3"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of Red Hat build of Debezium 3","product_id":"red_hat_build_of_debezium_3:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"red_hat_build_of_debezium_3"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of Red Hat Data Grid 8","product_id":"red_hat_data_grid_8:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"red_hat_data_grid_8"},{"category":"default_component_of","full_product_name":{"name":"jetty-eclipse as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:jetty-eclipse"},"product_reference":"jetty-eclipse","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"jetty-eclipse.src as a component of Red Hat Enterprise Linux 6","product_id":"red_hat_enterprise_linux_6:jetty-eclipse.src"},"product_reference":"jetty-eclipse.src","relates_to_product_reference":"red_hat_enterprise_linux_6"},{"category":"default_component_of","full_product_name":{"name":"maven-site-plugin-javadoc as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:maven-site-plugin-javadoc"},"product_reference":"maven-site-plugin-javadoc","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"maven-site-plugin.src as a component of Red Hat Enterprise Linux 7","product_id":"red_hat_enterprise_linux_7:maven-site-plugin.src"},"product_reference":"maven-site-plugin.src","relates_to_product_reference":"red_hat_enterprise_linux_7"},{"category":"default_component_of","full_product_name":{"name":"jmc as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:jmc"},"product_reference":"jmc","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"jmc.src as a component of Red Hat Enterprise Linux 9","product_id":"red_hat_enterprise_linux_9:jmc.src"},"product_reference":"jmc.src","relates_to_product_reference":"red_hat_enterprise_linux_9"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of Red Hat JBoss Enterprise Application Platform Expansion Pack","product_id":"red_hat_jboss_enterprise_application_platform_expansion_pack:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"red_hat_jboss_enterprise_application_platform_expansion_pack"},{"category":"default_component_of","full_product_name":{"name":"offline-knowledge-portal/rhokp-rhel9 as a component of Red Hat Offline Knowledge Portal","product_id":"red_hat_offline_knowledge_portal:offline-knowledge-portal/rhokp-rhel9"},"product_reference":"offline-knowledge-portal/rhokp-rhel9","relates_to_product_reference":"red_hat_offline_knowledge_portal"},{"category":"default_component_of","full_product_name":{"name":"rhoai/odh-spark-operator-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","product_id":"red_hat_openshift_ai_(rhoai):rhoai/odh-spark-operator-rhel9"},"product_reference":"rhoai/odh-spark-operator-rhel9","relates_to_product_reference":"red_hat_openshift_ai_(rhoai)"},{"category":"default_component_of","full_product_name":{"name":"rhoai/odh-th06-cpu-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","product_id":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch210-py312-rhel9"},"product_reference":"rhoai/odh-th06-cpu-torch210-py312-rhel9","relates_to_product_reference":"red_hat_openshift_ai_(rhoai)"},{"category":"default_component_of","full_product_name":{"name":"rhoai/odh-th06-cpu-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","product_id":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch291-py312-rhel9"},"product_reference":"rhoai/odh-th06-cpu-torch291-py312-rhel9","relates_to_product_reference":"red_hat_openshift_ai_(rhoai)"},{"category":"default_component_of","full_product_name":{"name":"rhoai/odh-th06-cuda130-torch210-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","product_id":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch210-py312-rhel9"},"product_reference":"rhoai/odh-th06-cuda130-torch210-py312-rhel9","relates_to_product_reference":"red_hat_openshift_ai_(rhoai)"},{"category":"default_component_of","full_product_name":{"name":"rhoai/odh-th06-cuda130-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","product_id":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch291-py312-rhel9"},"product_reference":"rhoai/odh-th06-cuda130-torch291-py312-rhel9","relates_to_product_reference":"red_hat_openshift_ai_(rhoai)"},{"category":"default_component_of","full_product_name":{"name":"rhoai/odh-th06-rocm64-torch291-py312-rhel9 as a component of Red Hat OpenShift AI (RHOAI)","product_id":"red_hat_openshift_ai_(rhoai):rhoai/odh-th06-rocm64-torch291-py312-rhel9"},"product_reference":"rhoai/odh-th06-rocm64-torch291-py312-rhel9","relates_to_product_reference":"red_hat_openshift_ai_(rhoai)"},{"category":"default_component_of","full_product_name":{"name":"devspaces/openvsx-rhel9 as a component of Red Hat OpenShift Dev Spaces","product_id":"red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9"},"product_reference":"devspaces/openvsx-rhel9","relates_to_product_reference":"red_hat_openshift_dev_spaces"},{"category":"default_component_of","full_product_name":{"name":"devspaces/pluginregistry-rhel9 as a component of Red Hat OpenShift Dev Spaces","product_id":"red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9"},"product_reference":"devspaces/pluginregistry-rhel9","relates_to_product_reference":"red_hat_openshift_dev_spaces"},{"category":"default_component_of","full_product_name":{"name":"openvox-server.src as a component of Red Hat Satellite 6","product_id":"red_hat_satellite_6:openvox-server.src"},"product_reference":"openvox-server.src","relates_to_product_reference":"red_hat_satellite_6"},{"category":"default_component_of","full_product_name":{"name":"puppetserver as a component of Red Hat Satellite 6","product_id":"red_hat_satellite_6:puppetserver"},"product_reference":"puppetserver","relates_to_product_reference":"red_hat_satellite_6"},{"category":"default_component_of","full_product_name":{"name":"puppetserver.src as a component of Red Hat Satellite 6","product_id":"red_hat_satellite_6:puppetserver.src"},"product_reference":"puppetserver.src","relates_to_product_reference":"red_hat_satellite_6"},{"category":"default_component_of","full_product_name":{"name":"puppetserver.src (satellite-capsule:el8) as a component of Red Hat Satellite 6","product_id":"red_hat_satellite_6:puppetserver.src::satellite-capsule:el8"},"product_reference":"puppetserver.src::satellite-capsule:el8","relates_to_product_reference":"red_hat_satellite_6"},{"category":"default_component_of","full_product_name":{"name":"puppetserver (satellite-capsule:el8) as a component of Red Hat Satellite 6","product_id":"red_hat_satellite_6:puppetserver::satellite-capsule:el8"},"product_reference":"puppetserver::satellite-capsule:el8","relates_to_product_reference":"red_hat_satellite_6"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of Red Hat Single Sign-On 7","product_id":"red_hat_single_sign-on_7:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"red_hat_single_sign-on_7"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of streams for Apache Kafka 2","product_id":"streams_for_apache_kafka_2:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"streams_for_apache_kafka_2"},{"category":"default_component_of","full_product_name":{"name":"jetty-util as a component of streams for Apache Kafka 3","product_id":"streams_for_apache_kafka_3:jetty-util"},"product_reference":"jetty-util","relates_to_product_reference":"streams_for_apache_kafka_3"}]},"vulnerabilities":[{"cve":"CVE-2026-8384","cwe":{"id":"CWE-22","name":"Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')"},"discovery_date":"2026-07-14T10:01:20.042637+00:00","ids":[{"system_name":"Red Hat Bugzilla ID","text":"2499932"}],"notes":[{"category":"description","text":"A flaw was found in Eclipse Jetty. An attacker could craft a specially formed HTTP Uniform Resource Identifier (URI) that, when processed by Jetty, results in an unresolved path. While Jetty itself is not directly affected, web applications relying on Jetty to provide resolved paths may be confused, potentially leading to unintended information disclosure. This could allow an attacker to access sensitive files or directories that should otherwise be protected.","title":"Vulnerability description"},{"category":"summary","text":"jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications","title":"Vulnerability summary"},{"category":"other","text":"Moderate impact: This path confusion vulnerability in Eclipse Jetty affects web applications that rely on Jetty to provide resolved paths. While Jetty itself correctly handles these paths and prevents direct file serving, vulnerable web applications may misinterpret unresolved paths, potentially leading to information disclosure.","title":"Statement"},{"category":"general","text":"The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.","title":"CVSS score applicability"}],"product_status":{"known_affected":["openshift_developer_tools_and_services:jenkins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","red_hat_amq_broker_7:jetty-util","red_hat_build_of_apache_camel_-_hawtio_4:jetty-util","red_hat_build_of_apache_camel_4_for_quarkus_3:jetty-util","red_hat_build_of_apache_camel_for_spring_boot_4:jetty-util","red_hat_build_of_apicurio_registry_3:jetty-util","red_hat_build_of_debezium_3:jetty-util","red_hat_data_grid_8:jetty-util","red_hat_enterprise_linux_6:jetty-eclipse","red_hat_enterprise_linux_6:jetty-eclipse.src","red_hat_enterprise_linux_7:maven-site-plugin-javadoc","red_hat_enterprise_linux_7:maven-site-plugin.src","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_jboss_enterprise_application_platform_expansion_pack:jetty-util","red_hat_offline_knowledge_portal:offline-knowledge-portal/rhokp-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-spark-operator-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-rocm64-torch291-py312-rhel9","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9","red_hat_satellite_6:openvox-server.src","red_hat_satellite_6:puppetserver","red_hat_satellite_6:puppetserver.src","red_hat_satellite_6:puppetserver.src::satellite-capsule:el8","red_hat_satellite_6:puppetserver::satellite-capsule:el8","red_hat_single_sign-on_7:jetty-util","streams_for_apache_kafka_2:jetty-util","streams_for_apache_kafka_3:jetty-util"]},"references":[{"category":"self","summary":"Canonical URL","url":"https://access.redhat.com/security/cve/CVE-2026-8384"},{"category":"external","summary":"RHBZ#2499932","url":"https://bugzilla.redhat.com/show_bug.cgi?id=2499932"},{"category":"external","summary":"https://www.cve.org/CVERecord?id=CVE-2026-8384","url":"https://www.cve.org/CVERecord?id=CVE-2026-8384"},{"category":"external","summary":"https://nvd.nist.gov/vuln/detail/CVE-2026-8384","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-8384"},{"category":"external","summary":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108"}],"release_date":"2026-07-14T08:56:17.525000+00:00","remediations":[{"category":"workaround","details":"Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.","product_ids":["openshift_developer_tools_and_services:jenkins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","red_hat_amq_broker_7:jetty-util","red_hat_build_of_apache_camel_-_hawtio_4:jetty-util","red_hat_build_of_apache_camel_4_for_quarkus_3:jetty-util","red_hat_build_of_apache_camel_for_spring_boot_4:jetty-util","red_hat_build_of_apicurio_registry_3:jetty-util","red_hat_build_of_debezium_3:jetty-util","red_hat_data_grid_8:jetty-util","red_hat_enterprise_linux_6:jetty-eclipse","red_hat_enterprise_linux_6:jetty-eclipse.src","red_hat_enterprise_linux_7:maven-site-plugin-javadoc","red_hat_enterprise_linux_7:maven-site-plugin.src","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_jboss_enterprise_application_platform_expansion_pack:jetty-util","red_hat_offline_knowledge_portal:offline-knowledge-portal/rhokp-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-spark-operator-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-rocm64-torch291-py312-rhel9","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9","red_hat_satellite_6:openvox-server.src","red_hat_satellite_6:puppetserver","red_hat_satellite_6:puppetserver.src","red_hat_satellite_6:puppetserver.src::satellite-capsule:el8","red_hat_satellite_6:puppetserver::satellite-capsule:el8","red_hat_single_sign-on_7:jetty-util","streams_for_apache_kafka_2:jetty-util","streams_for_apache_kafka_3:jetty-util"]},{"category":"none_available","details":"Fix deferred","product_ids":["openshift_developer_tools_and_services:jenkins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","red_hat_amq_broker_7:jetty-util","red_hat_build_of_apache_camel_-_hawtio_4:jetty-util","red_hat_build_of_apache_camel_4_for_quarkus_3:jetty-util","red_hat_build_of_apache_camel_for_spring_boot_4:jetty-util","red_hat_build_of_apicurio_registry_3:jetty-util","red_hat_build_of_debezium_3:jetty-util","red_hat_data_grid_8:jetty-util","red_hat_enterprise_linux_6:jetty-eclipse","red_hat_enterprise_linux_6:jetty-eclipse.src","red_hat_enterprise_linux_7:maven-site-plugin-javadoc","red_hat_enterprise_linux_7:maven-site-plugin.src","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_jboss_enterprise_application_platform_expansion_pack:jetty-util","red_hat_offline_knowledge_portal:offline-knowledge-portal/rhokp-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-spark-operator-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-rocm64-torch291-py312-rhel9","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9","red_hat_satellite_6:openvox-server.src","red_hat_satellite_6:puppetserver","red_hat_satellite_6:puppetserver.src","red_hat_satellite_6:puppetserver.src::satellite-capsule:el8","red_hat_satellite_6:puppetserver::satellite-capsule:el8","red_hat_single_sign-on_7:jetty-util","streams_for_apache_kafka_2:jetty-util","streams_for_apache_kafka_3:jetty-util"]}],"scores":[{"cvss_v3":{"attackComplexity":"LOW","attackVector":"NETWORK","availabilityImpact":"NONE","baseScore":5.3,"baseSeverity":"MEDIUM","confidentialityImpact":"NONE","integrityImpact":"LOW","privilegesRequired":"NONE","scope":"UNCHANGED","userInteraction":"NONE","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","version":"3.1"},"products":["openshift_developer_tools_and_services:jenkins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","red_hat_amq_broker_7:jetty-util","red_hat_build_of_apache_camel_-_hawtio_4:jetty-util","red_hat_build_of_apache_camel_4_for_quarkus_3:jetty-util","red_hat_build_of_apache_camel_for_spring_boot_4:jetty-util","red_hat_build_of_apicurio_registry_3:jetty-util","red_hat_build_of_debezium_3:jetty-util","red_hat_data_grid_8:jetty-util","red_hat_enterprise_linux_6:jetty-eclipse","red_hat_enterprise_linux_6:jetty-eclipse.src","red_hat_enterprise_linux_7:maven-site-plugin-javadoc","red_hat_enterprise_linux_7:maven-site-plugin.src","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_jboss_enterprise_application_platform_expansion_pack:jetty-util","red_hat_offline_knowledge_portal:offline-knowledge-portal/rhokp-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-spark-operator-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-rocm64-torch291-py312-rhel9","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9","red_hat_satellite_6:openvox-server.src","red_hat_satellite_6:puppetserver","red_hat_satellite_6:puppetserver.src","red_hat_satellite_6:puppetserver.src::satellite-capsule:el8","red_hat_satellite_6:puppetserver::satellite-capsule:el8","red_hat_single_sign-on_7:jetty-util","streams_for_apache_kafka_2:jetty-util","streams_for_apache_kafka_3:jetty-util"]}],"threats":[{"category":"impact","details":"Moderate","product_ids":["openshift_developer_tools_and_services:jenkins.src","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel8","openshift_developer_tools_and_services:ocp-tools-4/jenkins-rhel9","red_hat_amq_broker_7:jetty-util","red_hat_build_of_apache_camel_-_hawtio_4:jetty-util","red_hat_build_of_apache_camel_4_for_quarkus_3:jetty-util","red_hat_build_of_apache_camel_for_spring_boot_4:jetty-util","red_hat_build_of_apicurio_registry_3:jetty-util","red_hat_build_of_debezium_3:jetty-util","red_hat_data_grid_8:jetty-util","red_hat_enterprise_linux_6:jetty-eclipse","red_hat_enterprise_linux_6:jetty-eclipse.src","red_hat_enterprise_linux_7:maven-site-plugin-javadoc","red_hat_enterprise_linux_7:maven-site-plugin.src","red_hat_enterprise_linux_9:jmc","red_hat_enterprise_linux_9:jmc.src","red_hat_jboss_enterprise_application_platform_expansion_pack:jetty-util","red_hat_offline_knowledge_portal:offline-knowledge-portal/rhokp-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-spark-operator-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cpu-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch210-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-cuda130-torch291-py312-rhel9","red_hat_openshift_ai_(rhoai):rhoai/odh-th06-rocm64-torch291-py312-rhel9","red_hat_openshift_dev_spaces:devspaces/openvsx-rhel9","red_hat_openshift_dev_spaces:devspaces/pluginregistry-rhel9","red_hat_satellite_6:openvox-server.src","red_hat_satellite_6:puppetserver","red_hat_satellite_6:puppetserver.src","red_hat_satellite_6:puppetserver.src::satellite-capsule:el8","red_hat_satellite_6:puppetserver::satellite-capsule:el8","red_hat_single_sign-on_7:jetty-util","streams_for_apache_kafka_2:jetty-util","streams_for_apache_kafka_3:jetty-util"]}],"title":"jetty: Eclipse Jetty: Path confusion vulnerability may lead to information disclosure in web applications"}]}