CVE-2018-12536 Eclipse Jetty Server generates error message containing sensitive information
Attackers can trigger an exception to reveal the full server file path via the default error handler in Eclipse Jetty.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2018-12536?
CVE-2018-12536 is a medium-severity vulnerability in Eclipse Jetty, published on 27 Jun 2018. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system.
Weakness: CWE-209
Which versions are affected by CVE-2018-12536?
4 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-server Maven | From 9.0.0 | 9.3.24.v20180605 |
org.eclipse.jetty:jetty-server Maven | From 9.0.0 | 9.3.24.v20180605 |
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.11.v20180605 |
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.11.v20180605 |
Products include Eclipse Jetty, Oracle Retail Xstore Point of Service.
How do I fix CVE-2018-12536?
Upgrade org.eclipse.jetty:jetty-server to a fixed version for your release line: 9.3.24.v20180605 or 9.4.11.v20180605.
Is CVE-2018-12536 being exploited?
There is no known exploitation of CVE-2018-12536 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Jetty
- CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
- CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server
- CVE-2018-12538 Access and integrity issue within Eclipse Jetty
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2025-5115 MadeYouReset HTTP/2 vulnerability
Sources
Also known as CLEANSTART-2026-FP59456, DEBIAN-CVE-2018-12536, GHSA-9rgv-h7x4-qw8g, UBUNTU-CVE-2018-12536.