🟡CVE-2026-10050, CVE-2026-10051, CVE-2026-6790, CVE-2026-8384

Overview

This advisory addresses several known security vulnerabilities identified in a third-party dependency used within DPGW: the embedded Eclipse Jetty web server.

Vulnerability Details

  • CVE ID: CVE-2026-10050, CVE-2026-10051, CVE-2026-6790, CVE-2026-8384
  • Dependency Name: org.eclipse.jetty (jetty-server, jetty-ee10-servlet/servlets, jetty-rewrite, jetty-ee10-proxy, jetty-http2-server, jetty-alpn-*, jetty-client — all resolved via the jetty.version property)
  • Affected Version of Dependency:
    • CVE-2026-10050, CVE-2026-10051: Jetty 12.0.0–12.0.35 and 12.1.0–12.1.9 (fixed in 12.0.36 / 12.1.10)
    • CVE-2026-6790, CVE-2026-8384: Jetty 12.0.0–12.0.34 and 12.1.0–12.1.8 (fixed in 12.0.35 / 12.1.9)
    • DPGW 1.13 ships Jetty 12.1.8, which is within all four affected ranges.
  • Severity Score (base):
    • CVE-2026-10050 — 8.7 High (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:N digest-auth bypass; GHSA-2fvj-hgj9-j2gr)
    • CVE-2026-10051 — 4.0 Low (CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N; GHSA-f4v5-65jj-pcr2)
    • CVE-2026-6790 — Low (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N; GHSA-7p3p-8qv8-m2vh)
    • CVE-2026-8384 — 5.3 Medium (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N; GHSA-w7x5-g22v-xqhr)

Affected Versions of DPGW

  • 1.13 — all releases (<= 1.13.29-REL), which bundle Jetty 12.1.8
    The 1.14 branch is not affected: it already ships Jetty 12.1.10 (from 1.14.08-REL; the branch HEAD is on 12.1.11), which is at or above the fixed version for all four CVEs. DPGW versions on the Jetty 12.0.x line are tracked separately.

Risk Assessment & Applicability

Usage
DPGW embeds Eclipse Jetty as its HTTP/HTTPS server (WebServerImpl). Plain connectors serve HTTP/1.1; HTTPS connectors additionally negotiate HTTP/2 via ALPN. DPGW uses jetty-server, the EE10 servlet stack, jetty-rewrite, and jetty-ee10-proxy (three transparent proxy servlets). Outbound HTTP initiated by DPGW itself uses Apache HttpClient 5, not Jetty’s HTTP client. Access-control decisions are made in AuthFilter based on the request path (getRequestURI()/getServletPath().startsWith(...)).

Analysis
CVE-2026-10050 — Jetty HTTP client Digest authentication bypass (base 8.7 High)
The flaw is in Jetty’s client-side DigestAuthentication, which computes Digest hashes using ISO-8859-1, allowing password character collisions. Not applicable to DPGW. DPGW does not use Jetty’s HTTP client for any deliberate outbound request (it uses Apache HttpClient 5), and never configures Digest/Basic authentication or an AuthenticationStore. Jetty’s client is only reached transitively through the transparent proxy servlets, which configure no authentication at all, so the vulnerable code path is never exercised.

CVE-2026-10051 — HTTP/1.1 trailer leak across requests (base 4.0 Low)
A first request’s trailers are retained and leaked into subsequent requests on the same persistent connection. Not applicable to DPGW. DPGW never reads or writes HTTP trailer fields (getTrailerFields/Trailer are unused), so leaked trailers are never consumed.

CVE-2026-6790 — request authority vs. Host header mismatch (base Low)
Jetty does not strictly enforce that the request authority matches the Host header, enabling redirect/virtual-host/reverse-proxy edge cases. Not applicable in DPGW’s standard deployment. DPGW does not install a ForwardedRequestCustomizer and does not make access-control or routing decisions from the Host authority; the server name is used only to construct redirect/callback URLs. DPGW is run standalone (own TLS termination), not as a virtual-host reverse-proxy backend relying on this behaviour.

CVE-2026-8384 — unresolved path traversal in request URI (base 5.3 Medium)
Jetty returns the unresolved request path (e.g. /public/../admin/x rather than the normalized /admin/x) for URIs containing traversal/parameter sequences. Jetty’s own alias checker still blocks direct file traversal, but downstream applications that make security decisions on the raw path can be misled. This is the applicable concern for DPGW: AuthFilter gates access using path-prefix checks (startsWith("/private/"), "/dw/", "/replica/", "/capture/"). A crafted, unresolved URI could cause these prefix checks to be evaluated against a non-canonical path, risking an incorrect authorization or routing decision.

Status
Affected

Severity Score in the context of DPGW: 5.3 Medium CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
The DPGW-context severity is governed by CVE-2026-8384, the only CVE whose vulnerable code path DPGW meaningfully exercises. CVE-2026-10050 (base 8.7 High), CVE-2026-10051 and CVE-2026-6790 are not applicable to DPGW’s usage and do not contribute to the effective severity.

Impact on DPGW

A remote, unauthenticated attacker could craft a request URI containing path-traversal/parameter sequences that Jetty forwards to the application in unresolved form. Because AuthFilter authorizes requests by matching path prefixes, a non-canonical path could lead to an incorrect access-control decision (integrity impact, Low). Direct file-system traversal remains blocked by Jetty’s alias checker, and the other three CVEs are not exploitable in DPGW’s configuration.

Remediation & Mitigations

Fix
Upgrade the embedded Jetty to a fixed version — 12.1.10 or later on the 12.1.x line (12.1.9 fixes CVE-2026-6790/CVE-2026-8384; 12.1.10 additionally fixes CVE-2026-10050/CVE-2026-10051). The 1.14 branch already ships this (Jetty 12.1.10 in 1.14.08-REL; 12.1.11 on branch HEAD).

Scheduled fix
– 1.13 — 1.13.30-REL (2026-07-23) – bump jetty.version from 12.1.8 to 12.1.11

User Actions

  • Upgrade to a DPGW 1.13.x release that bundles Jetty 12.1.10 or later once available.
  • Interim mitigation: front DPGW with a reverse proxy that normalizes/rejects request URIs containing ../; path-parameter traversal sequences, and restrict network exposure of the web tier to trusted clients.