NES for Jetty 9.4.x Release Notes

Security Fixes

• Fixed HTTP request smuggling caused by lax parsing of LF terminators in chunked transfer-encoding extensions in jetty-http (CVE-2026-19203).
• Fixed a condition where threads could remain blocked when handling reset HTTP/2 requests (CVE-2026-12611).

Security Fixes

• Digest Authentication bypass via ISO-8859-1 character encoding collision (CVE-2026-10050).

Notes

• This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 9.4.58.

Security Fixes

• Missing validation of HTTP request authority against the Host header, potentially leading to incorrect URI construction and virtual host selection (CVE-2026-6790).

Notes

• This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 9.4.58.

Security Fixes

• JASPI access control escalation (CVE-2026-5795).

Notes

• This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 9.4.58.

Security Fixes

• HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (CVE-2026-2332).

Notes

• This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 9.4.58.

Security Fixes

• Fixed improper input validation in jetty-http where malformed URIs were parsed differently than other common parsers, potentially allowing blocklist bypass in multi-component systems (CVE-2025-11143).

Notes

• This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 9.4.58.