https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Tue, 06 Oct 2026 08:24:51 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0500 certfr-2026-avi-0500 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0500 https://cve.radiocsirt.org/vuln/cleanstart-2026-ao61361 <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kafka-fips</p> <p>Multiple security vulnerabilities affect the kafka-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> <p><strong>Withdrawn by the publisher.</strong></p> <p><strong>Affected:</strong> CleanStart: kafka-fips</p> <p>Multiple security vulnerabilities affect the kafka-fips package. These issues are resolved in later releases. See references for individual vulnerability details.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ao61361 https://cve.radiocsirt.org/vuln/euvd-2026-274591 EUVD-2026-274591 https://cve.radiocsirt.org/vuln/euvd-2026-274591 https://cve.radiocsirt.org/vuln/fkie_cve-2025-11143 <p>The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.</p> <p>The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-11143 https://cve.radiocsirt.org/vuln/ghsa-wjpw-4j6x-6rwh <p><strong>Affected:</strong> Maven: org.eclipse.jetty:jetty-http</p> <p>The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:</p> <p>#### Invalid Scheme | URI | Jetty | uri-js (nodejs) | node-url(nodejs) | |---|---|---| --- | | `https&gt;://vulndetector.com/path` | scheme=`http&gt;`| scheme=`https` | invalid URI |</p> <p>#### Improper IPv4 mapped IPv6</p> <p>| URI | Jetty | System.Uri(CSharp) | curl(C) | |---|---|---| --- | | `http://[0:0:0:0:0:ffff:127.0.0.1]` | invalid | host=`[::ffff:127.0.0.1]` | host=`[::ffff:127.0.0.1]` | | `http://[::ffff:255.255.0.0]` | invalid | host=`[::ffff:255.255.0.0]` | host=`[::ffff:255.255.0.0]` |</p> <p>#### Incorrect IPv6 delimeter priority</p> <p>| URI | Jetty | urllib3(python) | furl(python) | Spring | chromium | |---|---|---| --- |---|---| | `http://[normal.com@]vulndetector.com/` | host=`[normal.com@]` | invalid | invalid | | | | `http://normal.com[user@vulndetector].com/` | host=`[noirmal.com@vulndetector | | | host=`normal.com` | invalid | | `http://normal.com[@]vulndetector.com/` | host=`normal.com[@] | | | host=`normal.com` | invalid |</p> <p>#### Incorrect delimeter priority</p> <p>| URI | Jetty | urllib3(python) | jersey | |---|---|---| --- | | `http://normal.com/#@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` | | `http://normal.com/?@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` |</p> <p>### Impact Differential parsing of URIs in systems using multiple components may result in security by-pass.…</p> <p><strong>Affected:</strong> Maven: org.eclipse.jetty:jetty-http</p> <p>The Jetty URI parser has some key differences compared to other common parsers when evaluating invalid or unusual URIs. Specifically:</p> <p>#### Invalid Scheme | URI | Jetty | uri-js (nodejs) | node-url(nodejs) | |---|---|---| --- | | `https&gt;://vulndetector.com/path` | scheme=`http&gt;`| scheme=`https` | invalid URI |</p> <p>#### Improper IPv4 mapped IPv6</p> <p>| URI | Jetty | System.Uri(CSharp) | curl(C) | |---|---|---| --- | | `http://[0:0:0:0:0:ffff:127.0.0.1]` | invalid | host=`[::ffff:127.0.0.1]` | host=`[::ffff:127.0.0.1]` | | `http://[::ffff:255.255.0.0]` | invalid | host=`[::ffff:255.255.0.0]` | host=`[::ffff:255.255.0.0]` |</p> <p>#### Incorrect IPv6 delimeter priority</p> <p>| URI | Jetty | urllib3(python) | furl(python) | Spring | chromium | |---|---|---| --- |---|---| | `http://[normal.com@]vulndetector.com/` | host=`[normal.com@]` | invalid | invalid | | | | `http://normal.com[user@vulndetector].com/` | host=`[noirmal.com@vulndetector | | | host=`normal.com` | invalid | | `http://normal.com[@]vulndetector.com/` | host=`normal.com[@] | | | host=`normal.com` | invalid |</p> <p>#### Incorrect delimeter priority</p> <p>| URI | Jetty | urllib3(python) | jersey | |---|---|---| --- | | `http://normal.com/#@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` | | `http://normal.com/?@vulndetector.com` | host=`vulndetector.com` | host=`normal.com` | host=`normal.com` |</p> <p>### Impact Differential parsing of URIs in systems using multiple components may result in security by-pass.…</p> https://cve.radiocsirt.org/vuln/ghsa-wjpw-4j6x-6rwh https://cve.radiocsirt.org/vuln/opensuse-su-2026:10300-1 <p>jetty-annotations-9.4.58-3.1 on GA media</p> <p>jetty-annotations-9.4.58-3.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10300-1 https://cve.radiocsirt.org/vuln/rhsa-2026:21773 <p>org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output</p> <p>org.eclipse.jetty/jetty-http: org.eclipse.jetty: Security bypass due to differential URI parsing org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing org.apache.logging.log4j/log4j-core: Apache Log4j Core: Man-in-the-middle attack due to incomplete hostname verification org.apache.logging.log4j/log4j-core: Apache Log4j Core: Log injection via CRLF sequences due to configuration attribute renames org.apache.logging.log4j/log4j-1.2-api: Apache Log4j 1-to-Log4j 2 bridge: Log processing denial of service due to improper XML escaping org.apache.logging.log4j/log4j-core: Apache Log4j Core: Invalid XML output causes denial of service in logging org.apache.logging.log4j: Apache Log4j JsonTemplateLayout: Denial of Service via invalid JSON output</p> https://cve.radiocsirt.org/vuln/rhsa-2026:21773 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-11143 <p><strong>Affected:</strong> Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9, Ubuntu:24.04:LTS: jetty9, Ubuntu:25.10: jetty9, Ubuntu:26.04:LTS: jetty12, Ubuntu:26.04:LTS: jetty9</p> <p>The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.</p> <p><strong>Affected:</strong> Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9, Ubuntu:24.04:LTS: jetty9, Ubuntu:25.10: jetty9, Ubuntu:26.04:LTS: jetty12, Ubuntu:26.04:LTS: jetty9</p> <p>The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-11143 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0611 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um Sicherheitsvorkehrungen zu umgehen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-0611