https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-06T05:30:51.974031+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2026-avi-0500 certfr-2026-avi-0500 — De multiples vulnérabilités ont été découvertes dans VMware Tanzu. Elles permettent à un attaquant de provoquer un prob… 2026-10-06T05:30:52.107596+00:00 certfr-2026-avi-0500 https://cve.radiocsirt.org/vuln/cleanstart-2026-ao61361 Withdrawn: CLEANSTART-2026-AO61361 — Security fixes for CVE-2024-6763, CVE-2025-11143, CVE-2025-12183, CVE-2025-12383, CVE-2025-66566, CVE-2025-67030, CVE-2… 2026-10-06T05:30:52.107641+00:00

Withdrawn by the publisher.

Affected: CleanStart: kafka-fips

Multiple security vulnerabilities affect the kafka-fips package. These issues are resolved in later releases. See references for individual vulnerability details.

 https://cve.radiocsirt.org/vuln/euvd-2026-274591 EUVD-2026-274591 2026-10-06T05:30:52.107675+00:00 EUVD-2026-274591 https://cve.radiocsirt.org/vuln/fkie_cve-2025-11143 fkie_cve-2025-11143 2026-10-06T05:30:52.107689+00:00

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

 https://cve.radiocsirt.org/vuln/ghsa-wjpw-4j6x-6rwh GHSA-wjpw-4j6x-6rwh — org.eclipse.jetty:jetty-http has different parsing of invalid URIs 2026-10-06T05:30:52.107712+00:00

Affected: Maven: org.eclipse.jetty:jetty-http

The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:

#### Invalid Scheme | URI | Jetty | uri-js (nodejs) | node-url(nodejs) | |---|---|---| --- | | `https>://vulndetector.com/path` | scheme=`http>`| scheme=`https` | invalid URI |

#### Improper IPv4 mapped IPv6

| URI | Jetty | System.Uri(CSharp) | curl(C) | |---|---|---| --- | | `http://[0:0:0:0:0:ffff:127.0.0.1]` | invalid | host=`[::ffff:127.0.0.1]` | host=`[::ffff:127.0.0.1]` | | `http://[::ffff:255.255.0.0]` | invalid | host=`[::ffff:255.255.0.0]` | host=`[::ffff:255.255.0.0]` |

#### Incorrect IPv6 delimeter priority

| URI | Jetty | urllib3(python) | furl(python) | Spring | chromium | |---|---|---| --- |---|---| | `http://[normal.com@]vulndetector.com/` | host=`[normal.com@]` | invalid | invalid | | | | `http://normal.com[user@vulndetector].com/` | host=`[noirmal.com@vulndetector | | | host=`normal.com` | invalid | | `http://normal.com[@]vulndetector.com/` | host=`normal.com[@] | | | host=`normal.com` | invalid |

#### Incorrect delimeter priority

| URI | Jetty | urllib3(python) | jersey | |---|---|---| --- | | `http://normal.com/#@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` | | `http://normal.com/?@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` |

### Impact Differential parsing of URIs in systems using multiple components may result in security by-pass.…

 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10300-1 openSUSE-SU-2026:10300-1 — jetty-annotations-9.4.58-3.1 on GA media 2026-10-06T05:30:52.107762+00:00

jetty-annotations-9.4.58-3.1 on GA media

 https://cve.radiocsirt.org/vuln/rhsa-2026:21773 RHSA-2026:21773 — Red Hat Security Advisory: Red Hat Offline Knowledge Portal security and content update 2026-10-06T05:30:52.107780+00:00

org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-11143 UBUNTU-CVE-2025-11143 2026-10-06T05:30:52.107809+00:00

Affected: Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9, Ubuntu:24.04:LTS: jetty9, Ubuntu:25.10: jetty9, Ubuntu:26.04:LTS: jetty12, Ubuntu:26.04:LTS: jetty9

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0611 WID-SEC-W-2026-0611 — Eclipse Jetty: Schwachstelle ermöglicht Umgehen von Sicherheitsvorkehrungen 2026-10-06T05:30:52.107840+00:00

Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um Sicherheitsvorkehrungen zu umgehen.