CVE-2019-10246 Information Exposure vulnerability in Eclipse Jetty

What is CVE-2019-10246?

CVE-2019-10246 is a medium-severity vulnerability in Eclipse Jetty, published on 22 Apr 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

Weakness: CWE-200, CWE-213

Which versions are affected by CVE-2019-10246?

6 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 25 products.

Products include Eclipse Jetty, Netapp Element, Netapp Oncommand System Manager, Netapp Snap Creator Framework, Netapp Snapcenter, Netapp Snapmanager and 19 more.

How do I fix CVE-2019-10246?

Upgrade org.eclipse.jetty:jetty-server to a fixed version for your release line: 9.2.28.v20190418, 9.3.27.v20190418 or 9.4.17.v20190418.

Is CVE-2019-10246 being exploited?

There is no known exploitation of CVE-2019-10246 in the wild and no public exploit code.

Other vulnerabilities in Eclipse Jetty

• CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request Critical 9.8
• CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server Critical 9.4
• CVE-2018-12538 Access and integrity issue within Eclipse Jetty High 8.8
• CVE-2026-10050 Digest authentication lossy encoding High 8.7
• CVE-2025-5115 MadeYouReset HTTP/2 vulnerability High 7.7

All Eclipse Jetty vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as CLEANSTART-2026-FC70331, GHSA-r28m-g6j9-r2h5.