https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T15:37:01.834448+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-05680 bdu:2023-05680 2026-10-02T15:37:02.011757+00:00 bdu:2023-05680 https://cve.radiocsirt.org/vuln/certfr-2021-avi-912 certfr-2021-avi-912 — De multiples vulnérabilités ont été découvertes dans IBM Qradar. Certaines d'entre elles permettent à un attaquant de p… 2026-10-02T15:37:02.011799+00:00 certfr-2021-avi-912 https://cve.radiocsirt.org/vuln/euvd-2026-25878 EUVD-2026-25878 2026-10-02T15:37:02.011819+00:00 EUVD-2026-25878 https://cve.radiocsirt.org/vuln/fkie_cve-2021-28169 fkie_cve-2021-28169 2026-10-02T15:37:02.011831+00:00

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

 https://cve.radiocsirt.org/vuln/ghsa-gwcr-j4wh-j3cq GHSA-gwcr-j4wh-j3cq — Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability 2026-10-02T15:37:02.011862+00:00

Affected: Maven: org.eclipse.jetty:jetty-servlets

Requests to the `ConcatServlet` and `WelcomeFilter` are able to access protected resources within the `WEB-INF` directory. For example a request to the `ConcatServlet` with a URI of `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

This occurs because both `ConcatServlet` and `WelcomeFilter` decode the supplied path to verify it is not within the `WEB-INF` or `META-INF` directories. It then uses this decoded path to call `RequestDispatcher` which will also do decoding of the path. This double decoding allows paths with a doubly encoded `WEB-INF` to bypass this security check.

### Impact This affects all versions of `ConcatServlet` and `WelcomeFilter` in versions before 9.4.41, 10.0.3 and 11.0.3.

### Workarounds

If you cannot update to the latest version of Jetty, you can instead deploy your own version of the [`ConcatServlet`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/ConcatServlet.java) and/or the [`WelcomeFilter`](https://github.com/eclipse/jetty.project/blob/4204526d2fdad355e233f6bf18a44bfe028ee00b/jetty-servlets/src/main/java/org/eclipse/jetty/servlets/WelcomeFilter.java) by using the code from the latest version of Jetty.

 https://cve.radiocsirt.org/vuln/gsd-2021-28169 gsd-2021-28169 2026-10-02T15:37:02.011900+00:00 gsd-2021-28169 https://cve.radiocsirt.org/vuln/oesa-2021-1249 OESA-2021-1249 — jetty security update 2026-10-02T15:37:02.011912+00:00

Affected: openEuler:20.03-LTS-SP1: jetty

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server (like Apache) in order\ to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\ featured web server for static and dynamic content. Unlike separate\ server/container solutions, this means that your web server and web\ application run in the same process, without interconnection overheads\ and complications. Furthermore, as a pure java component, Jetty can be simply\ included in your application for demonstration, distribution or deployment.\ Jetty is available on all Java supported platforms. \ %global extdesc \\ \ This package contains Security Fix(es): For Eclipse Jetty versions &lt;= 9.4.40, &lt;= 10.0.2, &lt;= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.(CVE-2021-28169)

 https://cve.radiocsirt.org/vuln/opensuse-su-2021:2005-1 openSUSE-SU-2021:2005-1 — Security update for jetty-minimal 2026-10-02T15:37:02.011939+00:00

Security update for jetty-minimal

 https://cve.radiocsirt.org/vuln/rhsa-2021:3225 RHSA-2021:3225 — Red Hat Security Advisory: Red Hat AMQ Streams 1.8.0 release and security update 2026-10-02T15:37:02.011959+00:00

snakeyaml: Billion laughs attack via alias feature netty: Information disclosure via the local system temporary directory netty: possible request smuggling in HTTP/2 due missing validation netty: Request smuggling via content-length header json-smart: uncaught exception may lead to crash or information disclosure jetty: Symlink directory exposes webapp directory contents jetty: Ambiguous paths can access WEB-INF jetty: Resource exhaustion when receiving an invalid large TLS frame jersey: Local information disclosure via system temporary directory jetty: requests to the ConcatServlet and WelcomeFilter are able to access protected resources within the WEB-INF directory apache-commons-io: Limited path traversal in Apache Commons IO 2.2 to 2.6 jetty: SessionListener can prevent a session from being invalidated breaking logout

 https://cve.radiocsirt.org/vuln/suse-su-2021:2005-1 SUSE-SU-2021:2005-1 — Security update for jetty-minimal 2026-10-02T15:37:02.011993+00:00

Security update for jetty-minimal

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2021-28169 UBUNTU-CVE-2021-28169 2026-10-02T15:37:02.012008+00:00

Affected: Ubuntu:14.04:LTS: jetty, Ubuntu:14.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty, Ubuntu:16.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to `/concat?/%2557EB-INF/web.xml` can retrieve the web.xml file. This can reveal sensitive information regarding the implementation of a web application.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0616 WID-SEC-W-2022-0616 — IBM Tivoli Network Manager: Mehrere Schwachstellen 2026-10-02T15:37:02.012035+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in IBM Tivoli Network Manager ausnutzen, um Dateien zu manipulieren und vertrauliche Informationen offenzulegen.