Nine Jetty security advisories published in October 2026

End Of Life releases can be commercially obtained with support from the Eclipse Jetty developers through Webtide or in strictly binary form from its partners HeroDevs and TuxCare.

On 15 October 2026 the Jetty project published nine security advisories. The fixes themselves are not new: they shipped at the start of September in Jetty 12.1.13 and 12.0.39 on Maven Central, and in the End-of-Life releases 11.0.33, 10.0.33 and 9.4.65 for our support customers. Webtide customers were told about them privately when the releases came out. Now that the advisories are public, here is a short tour of what was fixed.

If you already run Jetty 12.1.13 / 12.0.39 or later, you are covered for all nine. The current releases are 12.1.14 and 12.0.40, and those are the ones we recommend.

At a glance

CVE	Severity	Area	12.1	12.0	11.0 / 10.0 / 9.4 (EOL)
CVE-2026-19863	Critical	EthereumAuthenticator	12.1.13	not affected	not affected
CVE-2026-77711	High	HttpClient proxy authentication	12.1.13	12.0.39	11.0.33 / 10.0.33 / 9.4.65
CVE-2026-76184	High	HttpClient redirects	12.1.13	12.0.39	11.0.33 / 10.0.33 / 9.4.65
CVE-2026-18660	High	Proxy blacklist	12.1.12	12.0.39	11.0.33 / 10.0.33 / 9.4.65
CVE-2026-18661	High	@ServletSecurity	12.1.12	12.0.39	11.0.33 / 10.0.33 / 9.4.65
CVE-2026-19864	Medium	Session persistence	12.1.13	12.0.39	11.0.33 / 10.0.33 / 9.4.65
CVE-2026-76182	Medium	TryPathsHandler	12.1.13	12.0.39	11.0.33 / 10.0.33 / 9.4.65
CVE-2026-18659	Medium	http-method-omission	12.1.12	12.0.39	11.0.33 / 10.0.33 / 9.4.65
CVE-2026-18662	Medium	http-method-omission	12.1.12	12.0.39	11.0.33 / 10.0.33 / 9.4.65

The table shows the first release with the fix. On 12.1, a few fixes were already in 12.1.12.

Authentication and authorization

CVE-2026-19863 (Critical): EthereumAuthenticator login path bypass

EthereumAuthenticator, from the Sign-In with Ethereum module (jetty-ethereum, 12.1 only), looked for its login path anywhere in the request path instead of matching it exactly. With a login path of /login, an unauthenticated request to /protected/login/secret skipped the authentication and role checks. There is no configuration workaround, so upgrade. If you don’t use jetty-ethereum, you are not affected.

CVE-2026-18661 (High): @ServletSecurity ignored for other mappings

Take a servlet annotated with @ServletSecurity and mapped to several URL patterns. If web.xml declares a <security-constraint> for just one of those patterns, Jetty dropped the annotation for all of them, leaving the other mappings unprotected. A tell-tale sign is this warning at startup: Constraints already defined for <class>, skipping ServletSecurity annotation. Until you upgrade, declare a constraint in web.xml for every mapping of the servlet.

CVE-2026-18659 and CVE-2026-18662 (Medium): <http-method-omission> handling

Two bugs in the same code, fixed together:

• The omission check used a substring match, so a constraint omitting PROPPATCH also left PATCH unprotected. The same goes for UNLOCK/LOCK, UNBIND/BIND and UNLINK/LINK.
• Two constraints with the same omission set overwrote each other instead of being combined, so the order of web.xml decided the result.

Until you upgrade, prefer explicit <http-method> constraints, merge duplicate constraints, and add <deny-uncovered-http-methods/> to web.xml, which is a good idea anyway.

CVE-2026-19864 (Medium): plaintext passwords in persisted sessions

With form or basic authentication, SessionAuthentication kept the user’s password and wrote it out in clear text every time a session was persisted (file store, JDBC, Redis, Hazelcast, Infinispan, MongoDB…). If you persist sessions with these authenticators, treat your session store as a password leak. Upgrade, and keep in mind that passwords already written to the store stay there until those sessions are removed. Rotate the affected credentials.

HttpClient

CVE-2026-77711 (High): proxy credentials sent to an HTTPS site

When HttpClient reached an HTTPS site through an authenticating HTTP proxy, a malicious site could answer with a fake 407 Proxy Authentication Required from inside the TLS tunnel, and the client would hand it the proxy username and password. Until you upgrade, avoid configuring a replayable proxy credential, or only talk to sites you trust.

CVE-2026-76184 (High): credentials leaked through a redirect

HttpClient matched cached credentials against the raw path before removing .. segments. A redirect to /private/../privateevil/collect was therefore sent the credential meant for /private/. Until you upgrade, HttpClient.setFollowRedirects(false) avoids the problem.

Proxy

CVE-2026-18660 (High): case-sensitive proxy blacklist

ProxyServlet and ConnectHandler compared host names against the blacklist case-sensitively, so LOCALHOST:8080 slipped past a localhost:8080 entry. Using a whitelist instead of a blacklist avoids it.

TryPathsHandler

CVE-2026-76182 (Medium): query parameter injection

With a fallback such as /index.php?p=$path, TryPathsHandler copied the decoded path into the query string, so a request for /article%26role=admin became /index.php?p=/article&role=admin. How much that matters depends on what the application behind it does with the extra parameter. On 9.4, 10 and 11 the same code lives in the FastCGI TryFilesFilter. If you use neither, you are not affected.

What should you do?

• Jetty 12: upgrade to the latest 12.1.x or 12.0.x from Maven Central.
• Jetty 9.4, 10 and 11 are End of Life and are no longer published to Maven Central. Releases 9.4.65, 10.0.33 and 11.0.33 with these fixes are available to Webtide EOL support customers. If you are still on one of these versions, get in touch. We can also help you move to Jetty 12.

Thanks to the security researchers who reported these issues responsibly. If you find a Jetty vulnerability, please follow these instructions or email security@jetty.org.