Maven Package Vulnerabilities

Open in search

Vulnerabilities associated with org.eclipse.jetty:jetty-server.

Packages

Clear package

Showing 25 vulnerabilities on this page for org.eclipse.jetty:jetty-server

Signals CISA KEV Ransomware Nuclei
VulnerabilityTitle and contextCVSSEPSSPoCsSignals

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

CWE-400CWE-401Jul 14, 2026
CVSS7.5v3.1EPSS0.252%PoCs0SignalsSTIX

Eclipse Jetty: HTTP Authority/Host mismatch

In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present). This was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112). This mismatch can cause a number of problems that may be classified as vulnerabilities such as: * URI constructions (for example, for redirects -- this is typical for login p…

CWE-20Jul 14, 2026
CVSS5.3v3.1EPSS0.196%PoCs0SignalsSTIX

Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.

CWE-200Jul 14, 2026
CVSS6.9v4.0EPSS0.302%PoCs0SignalsSTIX

The Eclipse Jetty Server Artifact has a Gzip request memory leak

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing …

CWE-400CWE-401CWE-772Mar 5, 2026
CVSS7.5v3.1EPSS0.625%PoCs0SignalsSTIX

Eclipse Jetty GZIP buffer release

In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

CWE-404May 8, 2025
CVSS7.2v3.1EPSS0.525%PoCs0SignalsSTIX

Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

CWE-400CWE-770Oct 14, 2024
CVSS5.9v3.1EPSS1.03%PoCs0SignalsSTIX

Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE="b; JSESSIONID=1337; c=d"` will be…

CWE-200Apr 18, 2023
CVSS2.4v3.1EPSS1.3%PoCs0SignalsSTIX

OutOfMemoryError for large multipart without filename in Eclipse Jetty

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker …

CWE-400CWE-770Apr 18, 2023
CVSS5.3v3.1EPSS3.26%PoCs0SignalsSTIX

Jetty SslConnection does not release pooled ByteBuffers in case of errors

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

CWE-404CWE-664Jul 7, 2022
CVSS7.5v3.1EPSS2.05%PoCs0SignalsSTIX

SessionListener can prevent a session from being invalidated breaking logout

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

CWE-613Jun 22, 2021
CVSS2.9v3.1EPSS0.963%PoCs0SignalsSTIX

Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CWE-400CWE-551CWE-755Apr 1, 2021
CVSS7.5v3.1EPSS53.9%PoCs0SignalsSTIX

DOS vulnerability for Quoted Quality CSV headers

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

CWE-400CWE-407Feb 26, 2021
CVSS5.2v3.1EPSS78%PoCs2SignalsSTIX

Buffer not correctly recycled in Gzip Request inflation

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data…

CWE-226Nov 28, 2020
CVSS4.8v3.1EPSS8.11%PoCs0SignalsSTIX

Operation on a Resource after Expiration or Release in Jetty Server

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then …

CWE-672CWE-675Jul 9, 2020
CVSS9.4v3.1EPSS11.1%PoCs0SignalsSTIX

Unescaped exception messages in error responses in Jetty

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

CWE-79Nov 25, 2019
CVSS6.1v3.1EPSS1.91%PoCs0SignalsSTIX

Installation information leak in Eclipse Jetty

In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured fully qualified directory base resource location on the output of the 404 error for not finding a Context that matches the requested path. The default server behavior on jetty-distribution and jetty-home will include at the end of the Handler tree a DefaultHandler, which is responsible for reporting this 404 error, it p…

CWE-200CWE-213Apr 22, 2019
CVSS5.3v3.1EPSS5.78%PoCs0SignalsSTIX

Cross-site Scripting in Eclipse Jetty

In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents.

CWE-79Apr 22, 2019
CVSS6.1v3.1EPSS9.59%PoCs0SignalsSTIX

Information Exposure vulnerability in Eclipse Jetty

In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a remote client when it is configured for showing a Listing of directory contents. This information reveal is restricted to only the content in the configured base resource directories.

CWE-200CWE-213Apr 22, 2019
CVSS5.3v3.1EPSS4.02%PoCs0SignalsSTIX

Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

CWE-400CWE-770Mar 27, 2019
CVSS7.5v3.1EPSS5.08%PoCs0SignalsSTIX

Eclipse Jetty Server generates error message containing sensitive information

In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the…

CWE-209Jun 27, 2018
CVSS5.3v3.1EPSS4.33%PoCs0SignalsSTIX

Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermed…

CWE-444Jun 26, 2018
CVSS9.8v3.1EPSS21%PoCs0SignalsSTIX

Critical severity vulnerability that affects org.eclipse.jetty:jetty-server

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allo…

CWE-190CWE-444Jun 26, 2018
CVSS9.8v3.1EPSS16.2%PoCs0SignalsSTIX

Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HT…

CWE-444Jun 26, 2018
CVSS7.5v3.0EPSS6.24%PoCs0SignalsSTIX

Access and integrity issue within Eclipse Jetty

In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSessions present in the FileSystem's storage for the FileSessionDataStore.

CWE-384CWE-6Jun 22, 2018
CVSS8.8v3.0EPSS2.69%PoCs0SignalsSTIX

Jetty vulnerable to exposure of sensitive information due to observable discrepancy

Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before rejection of incorrect passwords.

CWE-200CWE-203Jun 16, 2017
CVSS7.5v3.1EPSS5.8%PoCs0SignalsSTIX