Jetty 11.0.26 affected by 3rd-party vulnerabilities

Current Situation

JS7 JOC Cockpit ships with Jetty 11.0.26.

This version is affected by a number of vulnerabilities originating directly from Jetty and from its 3rd-party Java libraries..

The vulnerable components are:

• Jetty (used jetty-home 11.0.26)
  • jetty-http 11.0.26
    • CVE-2025-11143, CVE-2026-2332
  • http2-common 11.0.26
    • CVE-2025-1948
• used 3rd parties of jetty-home 11.0.26
  • netty-handler 4.1.58.Final
    • CVE-2021-21290, CVE-2023-34462, CVE-2026-44249, CVE-2026-45416, CVE-2026-50010
  • netty-codec 4.1.58.Final
    • CVE-2021-37136, CVE-2021-37137, CVE-2022-41915, CVE-2025-58057, CVE-2026-42583
  • netty-common 4.1.58.Final
    • CVE-2021-21290, CVE-2024-47535
  • netty-transport-native-epoll 4.1.58.Final
    • CVE-2026-45536
  • infinispan-core 11.0.19.Final
    • CVE-2025-0736
  • infinispan-client-hotrod 11.0.19.Final
    • CVE-2023-4586
  • wildfly-elytron 1.12.1.Final
    • CVE-2021-3642, CVE-2022-3143, CVE-2024-1233
  • wildfly-elytron-mechanism-scram 1.12.1.Final
    • CVE-2021-3642
  • wildfly-elytron-realm-token 1.12.1.Final
    • CVE-2024-1233
  • avro 1.7.6
    • CVE-2023-39410, CVE-2024-47561, CVE-2025-33042
  • jackson-mapper-asl 1.9.13
    • CVE-2017-7525, CVE-2019-10172, CVE-2019-10202

Maintainer Notes

• No fixed version of Jetty 11 is publicly available.
  • The Jetty project switched support policies in January 2026 and limits providing fixes for Jetty to one year in the life of a branch.
  • In fact, later fixes are available from a number of companies that require users entering a paid support contract.
  • The Jetty support model does not allow shipping fixes in scope of an Open Source solution such as JS7 as their support model is focused on individual end users and does not provide GPLv3 compliant fixes.
• The latest version is Jetty 11.0.26
• Branch 2.9 of JS7 will use Jetty 12 that includes fixes for the above vulnerabilities.