VDB
DEBIAN-CVE-2026-5795
DEBIAN-CVE-2026-5795
PUBLISHED
CVSS 7.400000095367432 HIGH
Record from OSV · Published April 8, 2026
In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.
Risk scores
CVSS 3.1
7.400000095367432
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N
Affected products
| Vendor | Product | Versions |
|---|---|---|
| Debian:14 | jetty9 | 0, 9.4.57-1, 9.4.57-1.1 |
| Debian:13 | jetty9 | 0, 9.4.57-1, 9.4.57-1.1 |
| Debian:14 | jetty12 | 0, 12.0.17-3, 12.0.17-3.1 |
| Debian:13 | jetty12 | 0, 12.0.17-3, 12.0.17-3.1 |
| Debian:12 | jetty9 | 0, 9.4.50-4, 9.4.50-4+deb12u1 |
Timeline
- Apr 8, 2026 CVE Published
- Oct 1, 2026 CVE Updated
Query this with the API
The same record, from the CLI:
vulnetix vdb vuln DEBIAN-CVE-2026-5795
vulnetix vdb fixes DEBIAN-CVE-2026-5795Or with curl, using the org id and key from your account page:
curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
"https://api.vdb.vulnetix.com/v2/vuln/DEBIAN-CVE-2026-5795/fixes/registry"The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart