apache / apache/maven-site-plugin

Jetty deps are vulnerable to CVE-2026-2332, which NIST flags as CRITICAL

Open Beginner friendly
#1,274 7 comments 0 reactions 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
55
Forks
50
Avg merge
2d 7h
Merged PRs (30d)
11

Description

### New feature, improvement proposal

First, thank you very much for developing the maven-site-plugin and releasing it to the general public.

https://github.com/apache/maven-site-plugin/blob/55ebd9fb33a76b2f3aaf81dfdf4e8475bb3e4b4b/pom.xml#L200

As per https://nvd.nist.gov/vuln/detail/CVE-2026-2332, the Eclipse Jetty Suite is vulnerable to "request smuggling" and the NIST marks the severity of this vulnerability as critical.

Would it be possible to bump the jetty dependency to >=9.4.60 and release?

Thanks again and cheers,
--
Christopher

Contributor guide

No contributing guide indexed for this repository

Research direction

Start in pom.xml around line 200, where the Jetty dependency is referenced, and compare its version with the NIST CVE-2026-2332 report. Update the dependency to version 9.4.60 or newer, then verify that the project resolves the updated Jetty version and that the change is ready for a release.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system, security
Issue type
Bug
Difficulty
2/5
Estimated time
1-3 hours
Activity status
Quiet
Clarity
Clearly specified
Newbie friendliness
68/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.