NES for Jetty 10.0.x Release Notes

Security Fixes

• Fixed a servlet authorization constraint bypass when an HTTP method name is a substring of an http-method-omission (CVE-2026-18659).
• Fixed duplicate http-method-omission constraint mappings that could remove servlet authorization constraints (CVE-2026-18662).
• Fixed @ServletSecurity suppression caused by web descriptor overlap (CVE-2026-18661).
• Fixed the proxy host blocklist to match case-insensitive DNS hostnames case-insensitively (CVE-2026-18660).
• Fixed HttpClient accepting proxy authentication challenges from an HTTPS origin and disclosing proxy credentials inside the tunnel (CVE-2026-77711).
• Fixed HttpClient leaking scoped credentials across path boundaries after a dot-segment redirect (CVE-2026-76184).
• Fixed FCGI TryFilesFilter query-parameter injection through decoded path interpolation (CVE-2026-76182).
• Fixed SessionAuthentication serializing a plaintext password to the session store (CVE-2026-19864).

Security Fixes

• Fixed a condition where threads could remain blocked when handling reset HTTP/2 requests (CVE-2026-12611).
• Fixed HTTP request smuggling caused by lax parsing of LF terminators in chunked transfer-encoding extensions in jetty-http (CVE-2026-19203).
• Fixed a WebSocket flaw where a reserved opcode could bypass the frame-size limit, leading to out-of-memory (OOM) (CVE-2026-19204).

Security Fixes

• Fixed improper input validation in jetty-http where malformed URIs were parsed differently than other common parsers, potentially allowing blocklist bypass in multi-component systems (CVE-2025-11143).

Security Fixes

• Digest Authentication bypass via ISO-8859-1 character encoding collision (CVE-2026-10050).

Security Fixes

• Missing validation of HTTP request authority against the Host header, potentially leading to incorrect URI construction and virtual host selection (CVE-2026-6790).

Security Fixes

• JASPI access control escalation (CVE-2026-5795).

Security Fixes

• HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (CVE-2026-2332).

Security Fixes

• Fixed improper input validation in jetty-http where malformed URIs were parsed differently than other common parsers, potentially allowing blocklist bypass in multi-component systems (CVE-2025-11143). (Resolved in 10.0.31.1)

Notes

• This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 10.0.26.