CVE-2026-5795
High · 7.4CVSS
7.4
EPSS
0.6%
Published
Apr 8, 2026
CISA due date
—
The record
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Affected packages
| Ecosystem | Package | Introduced | Fixed |
|---|---|---|---|
| openSUSE:Tumbleweed | jetty-minimal | 0 | 9.4.58-4.1 |
Related vulnerabilities
- CVE-2026-2332 In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk… Also affects jetty-minimal
- CVE-2025-11143 The Jetty URI parser has some key differences to other common parsers when evaluating… Also affects jetty-minimal
- CVE-2024-8184 Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks Also affects jetty-minimal
- CVE-2026-107315 pgjdbc, the PostgreSQL JDBC Driver, versions 42.7.4 through 42.7.13 pads a value that is… CWE-226
- CVE-2026-74791 Scriban before 7.0.0 fails to clear the CachedTemplates dictionary when… CWE-226
- CVE-2026-74250 In OpenStack Ironic before 38.0.1, the autodetect deploy interface may fail to run… CWE-226
- CVE-2026-48984 pam_usb provides hardware authentication for Linux using ordinary removable media. CWE-226
- CVE-2026-32960 SD-330AC and AMC Manager provided by silex technology, Inc. CWE-226