Eclipse Jetty: Schwachstelle ermöglicht Manipulation von Daten
WID-SEC-2026-1082 · first 14.04.2026 · updated 17.09.2026 · CVSS 7,4
What it is about
Eclipse Jetty ist ein Java-HTTP-Server und Java-Servlet-Container. Ein entfernter, anonymer Angreifer kann eine Schwachstelle in Eclipse Jetty ausnutzen, um Daten zu manipulieren.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- Daten zu manipulieren
Am I affected?
Affected according to the BSI:
- Red Hat Enterprise Linux
- SUSE Linux
- IBM Tivoli Netcool/OMNIbus
- IBM Operational Decision Manager
- IBM SPSS Modeler
- IBM Storage Scale
- SUSE openSUSE
- Red Hat Enterprise Linux Apache Camel for Spring Boot
- IBM Tivoli Network Manager IP Edition 4.2.0
- Eclipse Jetty <12.1.7
- Eclipse Jetty <12.0.33
- Eclipse Jetty <11.0.28
and 4 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Eclipse Jetty 12.1.7
- Eclipse Jetty 12.0.33
- Eclipse Jetty 11.0.28
- Eclipse Jetty 10.0.28
- Eclipse Jetty 9.4.60
Is the vulnerability already being exploited?
None of the CVEs is in the CISA catalogue of exploited vulnerabilities. That does not mean there are no attacks, only that none are documented.
Information and sources
- Original BSI advisory (WID)
- GitHub Security Advisory GHSA-355h-qmc2-wpwf vom 2026-04-13 github.com
- openSUSE Security Update OPENSUSE-SU-2026:10574-1 vom 2026-04-19 lists.opensuse.org
- Red Hat Security Advisory RHSA-2026:10175 vom 2026-04-23 access.redhat.com
- SUSE Security Update SUSE-SU-2026:1751-1 vom 2026-05-07 lists.suse.com
- Red Hat Security Advisory RHSA-2026:17668 vom 2026-05-14 access.redhat.com
- Red Hat Security Advisory RHSA-2026:20568 vom 2026-05-26 access.redhat.com
- Red Hat Security Advisory RHSA-2026:21773 vom 2026-05-29 access.redhat.com
- Red Hat Security Advisory RHSA-2026:22453 vom 2026-06-02 access.redhat.com
- Red Hat Security Advisory RHSA-2026:25089 vom 2026-06-10 access.redhat.com
- IBM Security Bulletin 7275937 vom 2026-06-11 www.ibm.com
- IBM Security Bulletin 7276757 vom 2026-06-17 www.ibm.com
- IBM Security Bulletin 7279060 vom 2026-07-03 www.ibm.com
- Red Hat Security Advisory RHSA-2026:50222 vom 2026-08-04 access.redhat.com
- Red Hat Security Advisory RHSA-2026:50221 vom 2026-08-04 access.redhat.com
- Red Hat Security Advisory RHSA-2026:50263 vom 2026-08-04 access.redhat.com
- Red Hat Security Advisory RHSA-2026:50223 vom 2026-08-04 access.redhat.com
- IBM Security Bulletin 7283059 vom 2026-08-10 www.ibm.com
- IBM Security Bulletin 7283637 vom 2026-08-13 www.ibm.com
- Red Hat Security Advisory RHSA-2026:60246 vom 2026-08-26 access.redhat.com
- Red Hat Security Advisory RHSA-2026:60251 vom 2026-08-26 access.redhat.com
- Red Hat Security Advisory RHSA-2026:60256 vom 2026-08-26 access.redhat.com
- Red Hat Security Advisory RHSA-2026:60254 vom 2026-08-26 access.redhat.com
- Red Hat Security Advisory RHSA-2026:60247 vom 2026-08-26 access.redhat.com
- Red Hat Security Advisory RHSA-2026:60248 vom 2026-08-26 access.redhat.com
- Red Hat Security Advisory RHSA-2026:60249 vom 2026-08-26 access.redhat.com
and 5 more sources in the original advisory
CVE: CVE-2026-2332
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.