A malformed HTTP URI containing a semicolon followed by a parent-directory reference causes Jetty to resolve the path to an intermediate form that still includes the ".." component, rather than collapsing it to the canonical path. Jetty itself denies access to the resulting file, but applications that rely on Jetty to deliver a fully normalized path can misinterpret the unresolved result and exhibit logic errors or unexpected behavior. The flaw is classified as CWE‑647, Path Manipulation.

Any installation of Eclipse Jetty that accepts incoming URIs with semicolons and relative directory references is potentially affected. No specific version constraints are listed, so the issue may impact all releases that present the same path‑handling behavior.

The CVSS score of 5.3 signals a medium severity, while the EPSS score of less than 1% indicates a low anticipated exploitation probability. The vulnerability is not recorded in CISA’s KEV catalogue. An attacker could exploit the problem by sending a crafted HTTP request from a remote host, which would trigger Jetty to provide an unresolved path to the application. Although no direct data access is granted, the resulting path confusion could lead to incorrect processing or exposure of internal paths within the application.