{"action":"Upgrade jetty9 to 9.4.39-3 or later.","affected":[{"fixed":"9.4.39-3","introduced":"0"}],"component":"jetty9","cve_ids":[],"ecosystem":"Debian","ecosystem_qualifier":"Debian:12","exploited":false,"fixed_versions":["9.4.39-3"],"id":"tcs_01M5NFRE7TGEJ3AMC0JN0RBYJX","modified_at":"2026-10-23T18:03:49.533667567Z","published_at":"2021-07-15T17:15:08.637Z","references":["https://osv.dev/vulnerability/DEBIAN-CVE-2021-34429","https://security-tracker.debian.org/tracker/CVE-2021-34429"],"severity":{"label":"medium","score":5.3},"sources":[{"source":"osv","source_id":"DEBIAN-CVE-2021-34429","url":"https://osv.dev/vulnerability/DEBIAN-CVE-2021-34429"}],"summary":"For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security co"}