Loading story…
German government CERT advisories disclosed two security issues in Eclipse Jetty, identifying one vulnerability that can lead to privilege escalation and another that can cause denial of service. The notices, tracked as dCERT Advisory 2026-0994 and dCERT Advisory 2026-0595, indicate that affected Jetty deployments may face both availability and access-control risks.
The advisories provide limited public detail, but together they show that organizations relying on Jetty should review exposed services and prioritize vendor guidance and patching for impacted versions. The combination of a privilege-escalation flaw and a DoS issue raises the risk of both service disruption and unauthorized elevation of access within environments running the Java web server and servlet container.
See affected versions and whether adversaries are exploiting it.
2 events from the most recent confirmed update back to the earliest known activity.
dCERT published advisory 2026-0994 for an Eclipse Jetty vulnerability that could allow privilege escalation. The reference does not include further details on affected versions, exploitation, or fixes.
dCERT published advisory 2026-0595 for an Eclipse Jetty vulnerability that could allow denial of service. No additional technical details or remediation timeline are provided in the reference.
See whether adversaries are exploiting this yet, and where the affected versions run in your environment.
2 references tracked. Mallory keeps watching after this page renders.
Map indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
Spring disclosed and national cyber agencies amplified six vulnerabilities in **Spring Tools** that affect developer environments for the Spring Java ecosystem, including **Spring Tools for Eclipse 5.2.0 and earlier** and **Spring Tools for VSCode, Cursor, and Theia 2.2.0 and earlier**. The most serious issues include **`CVE-2026-47858`**, which can expose Spring Boot applications started with live information mode to **JMX-based remote code execution**, and **`CVE-2026-47873`**, where the Boot Dashboard Docker integration publishes unauthenticated **JDWP** and **JMX** ports on **`0.0.0.0`** instead of limiting access to loopback, potentially exposing container control interfaces to the network. A third high-severity flaw, **`CVE-2026-47882`**, weakens Spring Boot DevTools remote restart authentication by generating the shared secret with a non-cryptographic pseudo-random number generator. Advisories also cited additional issues involving **plaintext logging of proxy credentials**, **cleartext storage of remote secrets**, and a **cross-site scripting** vulnerability. Italy's ACN and the Canadian Centre for Cyber Security said updates are available or pending through Spring security bulletins, with fixed versions identified as **Spring Tools for Eclipse 5.3.0** and **Spring Tools for VSCode, Cursor, and Theia 2.3.0**, and urged organizations to upgrade affected tooling.
Jul 30, 2026
Apache disclosed **CVE-2026-43512**, a moderate-severity authentication bypass in Tomcat's DIGEST authenticator that can let any user unknown to the configured Realm authenticate if the supplied password is `"null"`. The flaw affects multiple supported branches, including Tomcat `11.0.0-M1` through `11.0.21`, `10.1.0-M1` through `10.1.54`, and `9.0.0.M1` through `9.0.117`, with older unsupported releases potentially affected. Apache advised users to upgrade to `11.0.22+`, `10.1.55+`, or `9.0.118+`. Apache also disclosed **CVE-2026-44417**, a moderate-severity flaw in the JMS transport component of Apache CXF caused by an incomplete fix for **CVE-2025-48913**. The remaining vulnerable code path can still lead to remote code execution when untrusted users are allowed to configure JMS. Affected releases include CXF JMS transport `4.2.0` before `4.2.1`, `4.0.0` before `4.1.6`, and all `3.6.x` versions before `3.6.11`; Apache said organizations should upgrade to `4.2.1`, `4.1.6`, or `3.6.11`.
Aug 28, 2026
German authorities published security advisories for **Apache Traffic Server** and **Apache Tomcat/Tomcat Native**, warning of multiple vulnerabilities affecting the widely used web proxy, caching, and Java application server products. The notices identify separate issues in the two Apache projects, indicating that organizations running these technologies should review vendor guidance and determine whether exposed internet-facing services or internal application platforms are affected. The advisories provide limited public detail, but the affected software is commonly deployed in enterprise web delivery and application environments, raising the risk of service disruption, unauthorized access, or further compromise if vulnerable instances remain unpatched. Security teams are expected to prioritize asset identification, apply available updates from the Apache projects and downstream vendors, and monitor systems using **Apache Traffic Server**, **Apache Tomcat**, and **Tomcat Native** for signs of exploitation or abnormal activity.
Jun 29, 2026