In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served). However, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.

oracle CPUOct2026: MySQL Cluster >=9.7.0|<=9.7.4

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.38

oracle CPUOct2026: MySQL Cluster >=8.4.0|<=8.4.13

oracle CPUOct2026: MySQL Cluster >=8.0.0|<=8.0.50

oracle CPUOct2026: MySQL Cluster >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=8.4.0|<=8.4.13

oracle CPUOct2026: Oracle Siebel CRM

oracle CPUOct2026: MySQL Server >=26.7.0|<=26.7.2

oracle CPUOct2026: MySQL Server >=9.7.0|<=9.7.4

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of:
    /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it
    will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are
    served). However, web applications that rely on resolved paths being provided by Jetty may be confused
    when receiving an unresolved path. (CVE-2026-8384)

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available.

  - In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of:
    /public/../admin/secret.txt instead of the expected: /admin/secret.txt Jetty itself is not affected, as it     will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are     served). However, web applications that rely on resolved paths being provided by Jetty may be confused     when receiving an unresolved path. (CVE-2026-8384)

Note that Nessus relies on the presence of the package as reported by the vendor.

ID	Name	Product	Family	Type	Severity
455494	Echo: org.eclipse.jetty:jetty-util: security update to 12.0.35	Tenable Cloud Security	Echo Local Security Checks	Local	medium
455494	Echo: org.eclipse.jetty:jetty-util: security update to 12.0.35	Tenable Self-Hosted Container Security	Echo Local Security Checks	Local	medium
445183	SCA: security update for org.eclipse.jetty:jetty-util (GHSA-w7x5-g22v-xqhr)	Tenable Cloud Security	SCA Checks	Local	medium
445183	SCA: security update for org.eclipse.jetty:jetty-util (GHSA-w7x5-g22v-xqhr)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
327131	Linux Distros Unpatched Vulnerability : CVE-2026-8384	Nessus	Misc.	Local	medium

Detections

Analytics

CVE-2026-8384

medium

Tenable Plugins

Coming Soon

medium

medium

medium

medium

medium