CVE-2026-8384
MediumAdvisory
Published 22 Jul 2026In the index since 5 Sept 2026
- Severity
- Medium
- worst across findings
- CVSS
- 5.3
- base score, highest
- EPSS
- 0.003
- 26th percentile
- CISA KEV
- Not listed
- no confirmed exploitation
- Charts affected
- 54
- of 17,781 indexed, latest versions
- Container images
- 44
- deployed by those charts
- Fix available
- 1 of 1
- affected package
Eclipse Jetty: Path parameter traversal
Carried by container images the latest versions of 54 of 17,781 indexed charts deploy, on 44 images.
| Affected package | Affected versions | Fixed in | Images |
|---|---|---|---|
| jetty-utilmaven | 12.0.9, 12.0.11, 12.0.12, 12.0.15+12 more | 12.0.35, 12.1.9 | 44 |
- OSV records
- GHSA-w7x5-g22v-xqhr
Charts affected
54 by stars
Container images carrying it
44 by charts deploying them
A fixed version is listed for 1 of the 1 affected package.
| Container image | Digest | Package | Fixed in | Used by |
|---|---|---|---|---|
| public.ecr.aws/ | 8e01c0305844 | jetty-util | 12.0.35 | 7 |
| apache/ | 0116fb802786 | jetty-util | 12.1.9 | 2 |
| apache/ | 77e3df905404 | jetty-util | 12.0.35 | 2 |
| gisaia/ | e612fc722e02 | jetty-util | 12.1.9 | 2 |
| gisaia/ | f667e0ee79be | jetty-util | 12.1.9 | 2 |
| gisaia/ | 4e693e7b6f37 | jetty-util | 12.1.9 | 2 |
| hazelcast/ | 991ddb27c251 | jetty-util | 12.0.35 | 2 |
| jenkins/ | c4098086090c | jetty-util | 12.1.9 | 2 |
| metabase/ | 9491ed11c901 | jetty-util | 12.1.9 | 2 |
| ghcr.io/ | 536358d7b17e | jetty-util | 12.0.35 | 2 |
| ghcr.io/ | 7752874e71d8 | jetty-util | 12.1.9 | 2 |
| ghcr.io/ | 3f2d14563495 | jetty-util | 12.1.9 | 2 |
| ghcr.io/ | 900e2b88bd08 | jetty-util | 12.1.9 | 2 |
| ghcr.io/ | 2a797804f08c | jetty-util | 12.1.9 | 2 |
| ghcr.io/ | 096b8bcbbe45 | jetty-util | 12.1.9 | 2 |
| public.ecr.aws/ | d20bd62f0182 | jetty-util | 12.0.35 | 2 |
| quay.io/ | ac434a48ac2b | jetty-util | 12.0.35 | 2 |
| alfio/ | 0c836a081446 | jetty-util | 12.0.35 | 1 |
| apache/ | 0305c26f19ed | jetty-util | 12.1.9 | 1 |
| apache/ | bff074a5d005 | jetty-util | 12.0.35 | 1 |
| confluentinc/ | 0ad069035863 | jetty-util | 12.0.35 | 1 |
| dbeaver/ | 87ab86d00f8c | jetty-util | 12.1.9 | 1 |
| dependencytrack/ | 1ba4f004e1ec | jetty-util | 12.1.9 | 1 |
| gridgain/ | 5ab838d7d3cb | jetty-util | 12.0.35 | 1 |
| keyfactor/ | 798fbbe00283 | jetty-util | 12.0.35 | 1 |
| library/ | 2caf944aa4a5 | jetty-util | 12.1.9 | 1 |
| library/ | 5ab4ab0358cf | jetty-util | 12.0.35 | 1 |
| library/ | 6c162e2432f8 | jetty-util | 12.1.9 | 1 |
| plantuml/ | 5f6f99ec2fc1 | jetty-util | 12.1.9 | 1 |
| resurfaceio/ | d5cda2f64109 | jetty-util | 12.0.35 | 1 |
| rtuszik/ | 21549c60f9e6 | jetty-util | 12.1.9 | 1 |
| soldevelo/ | cfdc08c2f577 | jetty-util | 12.0.35 | 1 |
| stain/ | b1d0c96f19ad | jetty-util | 12.0.35 | 1 |
| tchiotludo/ | c2824dc2ae44 | jetty-util | 12.1.9 | 1 |
| trinodb/ | 1565e8cac299 | jetty-util | 12.1.9 | 1 |
| trinodb/ | 38c6f24ab1a4 | jetty-util | 12.0.35 | 1 |
| trinodb/ | 6af989b0846d | jetty-util | 12.1.9 | 1 |
| vespaengine/ | 69b160f58211 | jetty-util | 12.0.35 | 1 |
| ghcr.io/ | 30d1a445acc7 | jetty-util | 12.0.35 | 1 |
| ghcr.io/ | 0601750a3ca4 | jetty-util | 12.0.35 | 1 |
| ghcr.io/ | 3b3670fce70b | jetty-util | 12.1.9 | 1 |
| ghcr.io/ | d2c3218c7f9f | jetty-util | 12.1.9 | 1 |
| public.ecr.aws/ | 9026dbbf280d | jetty-util | 12.0.35 | 1 |
| public.ecr.aws/ | c265156b00d1 | jetty-util | 12.0.35 | 1 |