CVE-2026-19864

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-19864
Import Source
https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19864.json
JSON Data
https://api.osv.dev/v1/vulns/CVE-2026-19864
Aliases
  • GHSA-q6wx-j9wr-fj7f
Downstream
CLSA (3)
DEBIAN (1)
Published
2026-10-15T09:41:25Z
Modified
2026-10-16T02:47:40Z
Severity
  • 5.6 (Medium) CVSS_V4 - CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
[none]
Details

Eclipse Jetty's SessionAuthentication retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext.

An attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.

Database specific 
{
    "cna_assigner":  "eclipse",
    "cwe_ids":  [
        "CWE-312"
    ],
    "osv_generated_from":  "https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/19xxx/CVE-2026-19864.json",
    "unresolved_ranges":  [
        {
            "extracted_events":  [
                {
                    "introduced":  "9.4.0"
                },
                {
                    "last_affected":  "9.4.64"
                },
                {
                    "introduced":  "10.0.0"
                },
                {
                    "last_affected":  "10.0.32"
                },
                {
                    "introduced":  "11.0.0"
                },
                {
                    "last_affected":  "11.0.32"
                }
            ],
            "source":  "AFFECTED_FIELD"
        }
    ]
}
References

Affected packages

Git / github.com/jetty/jetty.project

Affected ranges

Type
GIT
Repo
https://github.com/jetty/jetty.project
Events
Introduced
28100e8da711e44c0722ed10bd413ae862497539
Last Affected
bdf87d35991b6459dec358c6012412e329f110b3
Introduced
c8372b65bd15404de1444d68902c0455a3a69b64
Last Affected
99a51624fd3b9f5f387fce44b628abf0b491f432
Database specific
Show details 
{
    "extracted_events":  [
        {
            "introduced":  "12.0.0"
        },
        {
            "last_affected":  "12.0.38"
        },
        {
            "introduced":  "12.1.0"
        },
        {
            "last_affected":  "12.1.12"
        }
    ],
    "source":  "AFFECTED_FIELD"
}

Affected versions

jetty-12.*
jetty-12.0.0x
jetty-12.0.14
jetty-12.0.15
jetty-12.0.19
jetty-12.0.22
jetty-12.0.23
jetty-12.0.30
jetty-12.0.31
jetty-12.0.37
jetty-12.0.38
jetty-12.0.5
jetty-12.0.6
jetty-12.1.0.beta1
jetty-12.1.12
jetty-12.1.2
jetty-12.1.4
jetty-12.1.5

Database specific

source 
"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2026-19864.json"