Staging Environment: Content and features may be unstable or change without notice.
Search for packages
Package details: pkg:maven/org.eclipse.jetty/jetty-server@9.4.37
purl pkg:maven/org.eclipse.jetty/jetty-server@9.4.37
Tags Ghost
Next non-vulnerable version 9.4.57.v20241219
Latest non-vulnerable version 12.1.6
Risk 10.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-p7cu-h519-83hx
Aliases:
CVE-2021-28164
GHSA-v7ff-8wcx-gmc5
Authorization Before Parsing and Canonicalization in jetty Release 9.4.37 introduced a more precise implementation of [RFC3986](https://tools.ietf.org/html/rfc3986#section-3.3) with regards to URI decoding, together with some new compliance modes to optionally allow support of some URI that may have ambiguous interpretation within the Servlet specified API methods behaviours. The default mode allowed % encoded . characters to be excluded for URI normalisation, which is correct by the RFC, but is not assumed by common Servlet implementations. The default compliance mode allows requests with URIs that contain `%2e` or `%2e%2e` segments to access protected resources within the `WEB-INF` directory. For example a request to `/context/%2e/WEB-INF/web.xml` can retrieve the `web.xml` file. This can reveal sensitive information regarding the implementation of a web application. Workarounds found by HttpCompliance mode RFC7230_NO_AMBIGUOUS_URIS can be enabled by updating `start.d/http.ini` to include: jetty.http.compliance=RFC7230_NO_AMBIGUOUS_URIS.
9.4.38.v20210224
Affected by 7 other vulnerabilities.
Vulnerabilities fixed by this package (0)
Vulnerability Summary Aliases
This package is not known to fix vulnerabilities.

Date Actor Action Vulnerability Source VulnerableCode Version
2026-04-02T16:56:13.467910+00:00 GHSA Importer Fixing VCID-uuju-ey95-tyfq https://github.com/advisories/GHSA-m394-8rww-3jr7 38.1.0
2026-04-02T12:38:10.051297+00:00 GitLab Importer Affected by VCID-p7cu-h519-83hx https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty/jetty-server/CVE-2021-28164.yml 38.0.0
2026-04-01T13:01:50.690006+00:00 GithubOSV Importer Fixing VCID-uuju-ey95-tyfq https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2021/03/GHSA-m394-8rww-3jr7/GHSA-m394-8rww-3jr7.json 38.0.0