Critical
Security advisory
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
- Products
- Not specified
- Affected versions
- Not specified
- Fixed versions
- Not specified
- CVEs
- CVE-2016-4800
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 1 Nov 2026, 04:14 UTC · Revision 1
Source evidence
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.
osv:CVE-2016-4800
Complete source record
{
"id": "b361f90fb6198e7128a59c43d3114380d1aa574d9fc72c1a8f1f374ba39f9120",
"url": "https://osv.dev/vulnerability/CVE-2016-4800",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "CVE-2016-4800",
"summary": "The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes.",
"evidence": "osv:CVE-2016-4800",
"products": [],
"severity": "critical",
"structured": {
"id": "CVE-2016-4800",
"aliases": [
"CVE-2016-4800",
"GHSA-872g-2h8h-362q"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H"
}
],
"affected": [
{
"ranges": [
{
"repo": "https://github.com/jetty/jetty.project",
"type": "GIT",
"events": [
{
"introduced": "390f3200cce7f90f1f3ebc78013c1afea2f93db8"
},
{
"last_affected": "bee564c7d942447f02e8d87a2ea5fe30e651a59c"
}
],
"database_specific": {
"extracted_events": [
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.0:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.0"
},
{
"last_affected": "9.3.0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.0-m0"
},
{
"last_affected": "9.3.0-m0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.0-m1"
},
{
"last_affected": "9.3.0-m1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.0-maintenance2"
},
{
"last_affected": "9.3.0-maintenance2"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.0-rc0"
},
{
"last_affected": "9.3.0-rc0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.0-rc1"
},
{
"last_affected": "9.3.0-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.4-rc0"
},
{
"last_affected": "9.3.4-rc0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.4-rc1"
},
{
"last_affected": "9.3.4-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.5:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.5"
},
{
"last_affected": "9.3.5"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.6:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.6"
},
{
"last_affected": "9.3.6"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.7:*:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.7"
},
{
"last_affected": "9.3.7"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.7-rc0"
},
{
"last_affected": "9.3.7-rc0"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.7-rc1"
},
{
"last_affected": "9.3.7-rc1"
}
],
"source": "CPE_STRING"
},
{
"cpe": "cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:*",
"range": [
{
"introduced": "9.3.8-rc0"
},
{
"last_affected": "9.3.8-rc0"
}
],
"source": "CPE_STRING"
}
]
}
}
],
"versions": [
"9.3.0",
"9.3.0-m1",
"9.3.0-maintenance2",
"9.3.0-rc0",
"9.3.0-rc1",
"9.3.4-rc0",
"9.3.4-rc1",
"9.3.5",
"9.3.6",
"9.3.7",
"9.3.7-rc0",
"9.3.7-rc1",
"9.3.8-rc0"
],
"database_specific": {
"source": "https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2016-4800.json"
}
}
],
"modified": "2026-10-24T10:30:15.603630069Z",
"provider": "osv",
"references": [
"https://www.oracle.com/security-alerts/cpuoct2020.html",
"https://security.netapp.com/advisory/ntap-20190307-0006/"
],
"provider_metadata": {
"unresolved_ranges": [
{
"cpes": [
"cpe:2.3:a:eclipse:jetty:9.3.0:*:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.1:*:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.2:*:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.3:*:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.4:*:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.5:*:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.6:*:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.7:*:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.8:*:*:*:*:*:*:*",
"cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:*"
],
"vendor_product": "eclipse:jetty",
"extracted_events": [
{
"range": [
{
"introduced": "9.3.0"
},
{
"last_affected": "9.3.0"
},
{
"introduced": "9.3.0-m0"
},
{
"last_affected": "9.3.0-m0"
},
{
"introduced": "9.3.0-m1"
},
{
"last_affected": "9.3.0-m1"
},
{
"introduced": "9.3.0-maintenance2"
},
{
"last_affected": "9.3.0-maintenance2"
},
{
"introduced": "9.3.0-rc0"
},
{
"last_affected": "9.3.0-rc0"
},
{
"introduced": "9.3.0-rc1"
},
{
"last_affected": "9.3.0-rc1"
},
{
"introduced": "9.3.1"
},
{
"last_affected": "9.3.1"
},
{
"introduced": "9.3.1"
},
{
"last_affected": "9.3.1"
},
{
"introduced": "9.3.1"
},
{
"last_affected": "9.3.1"
},
{
"introduced": "9.3.2"
},
{
"last_affected": "9.3.2"
},
{
"introduced": "9.3.2"
},
{
"last_affected": "9.3.2"
},
{
"introduced": "9.3.2"
},
{
"last_affected": "9.3.2"
},
{
"introduced": "9.3.3"
},
{
"last_affected": "9.3.3"
},
{
"introduced": "9.3.3"
},
{
"last_affected": "9.3.3"
},
{
"introduced": "9.3.3"
},
{
"last_affected": "9.3.3"
},
{
"introduced": "9.3.4"
},
{
"last_affected": "9.3.4"
},
{
"introduced": "9.3.4"
},
{
"last_affected": "9.3.4"
},
{
"introduced": "9.3.4"
},
{
"last_affected": "9.3.4"
},
{
"introduced": "9.3.4-rc0"
},
{
"last_affected": "9.3.4-rc0"
},
{
"introduced": "9.3.4-rc1"
},
{
"last_affected": "9.3.4-rc1"
},
{
"introduced": "9.3.5"
},
{
"last_affected": "9.3.5"
},
{
"introduced": "9.3.6"
},
{
"last_affected": "9.3.6"
},
{
"introduced": "9.3.7"
},
{
"last_affected": "9.3.7"
},
{
"introduced": "9.3.7-rc0"
},
{
"last_affected": "9.3.7-rc0"
},
{
"introduced": "9.3.7-rc1"
},
{
"last_affected": "9.3.7-rc1"
},
{
"introduced": "9.3.8"
},
{
"last_affected": "9.3.8"
},
{
"introduced": "9.3.8"
},
{
"last_affected": "9.3.8"
},
{
"introduced": "9.3.8"
},
{
"last_affected": "9.3.8"
},
{
"introduced": "9.3.8-rc0"
},
{
"last_affected": "9.3.8-rc0"
}
],
"source": "CPE_STRING"
}
]
}
]
}
},
"related_cves": [
{
"value": "CVE-2016-4800",
"evidence": "/id"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 429183,
"published_at": "2017-04-13T14:59:01.76+00:00"
}