Maven/org.eclipse.jetty:jetty-jaspi CVE-2026-5795: high 7.4, EPSS 0.53%
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Action: Upgrade org.eclipse.jetty:jetty-jaspi to 9.4.61 (9.x), 10.0.29 (10.x) or 11.0.29 (11.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0 | 11.0.29 | - |
| 10.0.0 | 10.0.29 | - |
| 9.4.0 | 9.4.61 | - |
Fixed versions
| 11.0.29 | 10.0.29 | 9.4.61 |
Sources
- osv: GHSA-r7p8-xq5m-436c#Maven/org.eclipse.jetty:jetty-jaspi
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c
- https://nvd.nist.gov/vuln/detail/CVE-2026-5795
- https://github.com/jetty/jetty.project
- https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92
CVE-2026-5795 · published · modified · JSON