CVE-2026-5795
5 advisories.
Maven/org.eclipse.jetty.ee11:jetty-ee11-jaspi CVE-2026-5795: high 7.4, EPSS 0.61%
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Action: Upgrade org.eclipse.jetty.ee11:jetty-ee11-jaspi to 12.0.34 (12.0.x) or 12.1.8 (12.1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.1.0 | 12.1.8 | - |
| 12.0.0 | 12.0.34 | - |
Fixed versions
| 12.1.8 | 12.0.34 |
Sources
- osv: GHSA-r7p8-xq5m-436c
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c
- https://nvd.nist.gov/vuln/detail/CVE-2026-5795
- https://github.com/jetty/jetty.project
- https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92
CVE-2026-5795 · published · modified · JSON
Maven/org.eclipse.jetty.ee10:jetty-ee10-jaspi CVE-2026-5795: high 7.4, EPSS 0.61%
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Action: Upgrade org.eclipse.jetty.ee10:jetty-ee10-jaspi to 12.0.34 (12.0.x) or 12.1.8 (12.1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.1.0 | 12.1.8 | - |
| 12.0.0 | 12.0.34 | - |
Fixed versions
| 12.1.8 | 12.0.34 |
Sources
- osv: GHSA-r7p8-xq5m-436c#Maven/org.eclipse.jetty.ee10:jetty-ee10-jaspi
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c
- https://nvd.nist.gov/vuln/detail/CVE-2026-5795
- https://github.com/jetty/jetty.project
- https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92
CVE-2026-5795 · published · modified · JSON
Maven/org.eclipse.jetty.ee9:jetty-ee9-jaspi CVE-2026-5795: high 7.4, EPSS 0.61%
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Action: Upgrade org.eclipse.jetty.ee9:jetty-ee9-jaspi to 12.0.34 (12.0.x) or 12.1.8 (12.1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.1.0 | 12.1.8 | - |
| 12.0.0 | 12.0.34 | - |
Fixed versions
| 12.1.8 | 12.0.34 |
Sources
- osv: GHSA-r7p8-xq5m-436c#Maven/org.eclipse.jetty.ee9:jetty-ee9-jaspi
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c
- https://nvd.nist.gov/vuln/detail/CVE-2026-5795
- https://github.com/jetty/jetty.project
- https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92
CVE-2026-5795 · published · modified · JSON
Maven/org.eclipse.jetty.ee8:jetty-ee8-jaspi CVE-2026-5795: high 7.4, EPSS 0.61%
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Action: Upgrade org.eclipse.jetty.ee8:jetty-ee8-jaspi to 12.0.34 (12.0.x) or 12.1.8 (12.1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.1.0 | 12.1.8 | - |
| 12.0.0 | 12.0.34 | - |
Fixed versions
| 12.1.8 | 12.0.34 |
Sources
- osv: GHSA-r7p8-xq5m-436c#Maven/org.eclipse.jetty.ee8:jetty-ee8-jaspi
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c
- https://nvd.nist.gov/vuln/detail/CVE-2026-5795
- https://github.com/jetty/jetty.project
- https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92
CVE-2026-5795 · published · modified · JSON
Maven/org.eclipse.jetty:jetty-jaspi CVE-2026-5795: high 7.4, EPSS 0.61%
Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables
Action: Upgrade org.eclipse.jetty:jetty-jaspi to 9.4.61 (9.x), 10.0.29 (10.x) or 11.0.29 (11.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 11.0.0 | 11.0.29 | - |
| 10.0.0 | 10.0.29 | - |
| 9.4.0 | 9.4.61 | - |
Fixed versions
| 11.0.29 | 10.0.29 | 9.4.61 |
Sources
- osv: GHSA-r7p8-xq5m-436c#Maven/org.eclipse.jetty:jetty-jaspi
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436c
- https://nvd.nist.gov/vuln/detail/CVE-2026-5795
- https://github.com/jetty/jetty.project
- https://github.com/user-attachments/files/26118760/JaspiAuthenticator_Security_Report.pdf
- https://gitlab.eclipse.org/security/cve-assignment/-/issues/92
CVE-2026-5795 · published · modified · JSON