https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:07:50 +0000 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0667 certfr-2026-avi-0667 https://cve.radiocsirt.org/vuln/certfr-2026-avi-0667 https://cve.radiocsirt.org/vuln/cleanstart-2026-am26944 <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.</p> <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Security vulnerability affects the apache-nifi package. In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-am26944 https://cve.radiocsirt.org/vuln/euvd-2026-367730 EUVD-2026-367730 https://cve.radiocsirt.org/vuln/euvd-2026-367730 https://cve.radiocsirt.org/vuln/fkie_cve-2026-5795 <p>In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.</p> <p>Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.</p> <p>A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.</p> <p>In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.</p> <p>Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.</p> <p>A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2026-5795 https://cve.radiocsirt.org/vuln/ghsa-r7p8-xq5m-436c <p><strong>Affected:</strong> Maven: org.eclipse.jetty.ee11:jetty-ee11-jaspi, Maven: org.eclipse.jetty.ee10:jetty-ee10-jaspi, Maven: org.eclipse.jetty.ee9:jetty-ee9-jaspi, Maven: org.eclipse.jetty.ee8:jetty-ee8-jaspi, Maven: org.eclipse.jetty:jetty-jaspi</p> <p>### Description (as reported)</p> <p>A security vulnerability has been identified in Jetty&#39;s `JaspiAuthenticator.java`.</p> <p>The root cause is a failure to consistently clear authentication metadata stored in `ThreadLocal` during certain error or incomplete authentication flows. Specifically, after a `GroupPrincipalCallback` is persisted into the `ThreadLocal`, the authentication process may exit prematurely — before the `ThreadLocal` storage is cleared — if a mandatory `CallerPrincipalCallback` is missing or an exception occurs. This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.</p> <p>See also attached PDF.</p> <p>### Impact An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).</p> <p>### Patches No patches yet.</p> <p>### Workarounds Do not use Jetty&#39;s JASPI.</p> <p><strong>Affected:</strong> Maven: org.eclipse.jetty.ee11:jetty-ee11-jaspi, Maven: org.eclipse.jetty.ee10:jetty-ee10-jaspi, Maven: org.eclipse.jetty.ee9:jetty-ee9-jaspi, Maven: org.eclipse.jetty.ee8:jetty-ee8-jaspi, Maven: org.eclipse.jetty:jetty-jaspi</p> <p>### Description (as reported)</p> <p>A security vulnerability has been identified in Jetty&#39;s `JaspiAuthenticator.java`.</p> <p>The root cause is a failure to consistently clear authentication metadata stored in `ThreadLocal` during certain error or incomplete authentication flows. Specifically, after a `GroupPrincipalCallback` is persisted into the `ThreadLocal`, the authentication process may exit prematurely — before the `ThreadLocal` storage is cleared — if a mandatory `CallerPrincipalCallback` is missing or an exception occurs. This allows a subsequent, unprivileged user processed by the same worker thread to inherit these residual security roles, leading to Broken Access Control and Privilege Escalation.</p> <p>See also attached PDF.</p> <p>### Impact An unauthenticated user may gain ungrated privileges from a previous request (privilege escalation).</p> <p>### Patches No patches yet.</p> <p>### Workarounds Do not use Jetty&#39;s JASPI.</p> https://cve.radiocsirt.org/vuln/ghsa-r7p8-xq5m-436c https://cve.radiocsirt.org/vuln/ncsc-2026-0258 NCSC-2026-0258 https://cve.radiocsirt.org/vuln/ncsc-2026-0258 https://cve.radiocsirt.org/vuln/opensuse-su-2026:10574-1 <p>jetty-annotations-9.4.58-4.1 on GA media</p> <p>jetty-annotations-9.4.58-4.1 on GA media</p> https://cve.radiocsirt.org/vuln/opensuse-su-2026:10574-1 https://cve.radiocsirt.org/vuln/rhsa-2026:17668 <p>bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication Apache Camel: camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection Apache Camel: Camel-Mail: Camel-Mail: Altered application behavior via header injection io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corru…</p> <p>bouncycastle: BC-JAVA: GOSTCTR implementation unable to process more than 255 blocks correctly org.codehaus.plexus:plexus-utils: Plexus-utils: Directory Traversal in extractFile method bouncycastle: BC-JAVA: LDAP injection vulnerability in LDAPStoreHelper.java org.eclipse.jetty/jetty-http: HTTP request smuggling via chunked extension quoted-string parsing bouncycastle: BC-JAVA: unbounded PGP AEAD chunk size leads to pre-auth resource exhaustion bouncycastle: BC-JAVA: PKIX draft CompositeVerifier accepts empty signature sequence as valid org.eclipse.jetty.ee10/jetty-ee10: early return from the JASPIAuthenticator class without clearing ThreadLocal variables camel-infinispan: camel-infinispan: Remote Code Execution via Unsafe Deserialization Spring Boot: Spring Boot: Authentication bypass via misconfigured Health Group additional path org.apache.artemis:artemis-server: org.apache.activemq:artemis-server: Apache Artemis, Apache ActiveMQ Artemis: Message injection and exfiltration due to missing authentication Apache Camel: camel-coap: Apache Camel camel-coap: Remote code execution via CoAP URI query parameter injection Apache Camel: Camel-Mail: Camel-Mail: Altered application behavior via header injection io.netty/netty-codec-http: Netty: Request smuggling via incorrect parsing of HTTP/1.1 chunked transfer encoding extension values netty: Netty: Denial of Service via HTTP/2 CONTINUATION frame flood Apache Kafka Clients: Apache Kafka Clients: Information disclosure and data corru…</p> https://cve.radiocsirt.org/vuln/rhsa-2026:17668 https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-5795 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: jetty, Ubuntu:16.04:LTS: jetty, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9, Ubuntu:24.04:LTS: jetty9, Ubuntu:25.10: jetty9, Ubuntu:26.04:LTS: jetty9</p> <p>In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: jetty, Ubuntu:16.04:LTS: jetty, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9, Ubuntu:24.04:LTS: jetty9, Ubuntu:25.10: jetty9, Ubuntu:26.04:LTS: jetty9</p> <p>In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2026-5795 https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1014 <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um seine Privilegien zu erhöhen.</p> <p>Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um seine Privilegien zu erhöhen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2026-1014