Maven/org.eclipse.jetty.ee10:jetty-ee10-jaspi CVE-2026-5795: high 7.4, EPSS 0.53%
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Action: Upgrade org.eclipse.jetty.ee10:jetty-ee10-jaspi to 12.0.34 (12.0.x) or 12.1.8 (12.1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.1.0 | 12.1.8 | - |
| 12.0.0 | 12.0.34 | - |
Fixed versions
| 12.1.8 | 12.0.34 |
Sources
- osv: GHSA-r7p8-xq5m-436c#Maven/org.eclipse.jetty.ee10:jetty-ee10-jaspi
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c
- https://nvd.nist.gov/vuln/detail/CVE-2026-5795
- https://github.com/jetty/jetty.project
- https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92
CVE-2026-5795 · published · modified · JSON