Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.eclipse.jetty:jetty-http

5 known vulnerabilities (1 high, 1 medium, 3 low), with the versions each affects and the releases that fix them.

Latest release
12.1.14 (Oct 5, 2026): no advisory affects it
Newest unaffected release
12.1.14 (Oct 5, 2026), the latest release
Advisories
5 · 1 high, 1 medium, 3 low
Dependents
513
Releases
443 since 7.0.0.v20091005 (Oct 5, 2009)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2026-2332
    Affects 9.4.0.v20161208 to 9.4.58.v20250814 (10.0.0-alpha0 is outside it); 10.0.0 to 10.0.26 (11.0.0-alpha0 is outside it); 11.0.0 to 11.0.26 (12.0.0.alpha0 is outside it); 12.0.0 to 12.0.32 (12.0.33 is outside it); 12.1.0 to 12.1.6 (12.1.7 is outside it)
  • CVE-2025-11143
    Affects 9.4.0.v20161208 to 9.4.57.v20241219 (9.4.58.v20250814 is outside it); 10.0.0 to 10.0.26 (11.0.0-alpha0 is outside it); 11.0.0 to 11.0.26 (12.0.0.alpha0 is outside it); 12.0.0 to 12.0.30 (12.0.31 is outside it); 12.1.0 to 12.1.4 (12.1.5 is outside it)
  • CVE-2024-6763
    Affects 7.0.0.v20091005 to 12.0.11 (12.0.12 is outside it)
  • CVE-2023-40167
    Affects 9.0.0.v20130308 to 9.4.51.v20230217 (9.4.52.v20230823 is outside it); 10.0.0 to 10.0.15 (10.0.16 is outside it); 11.0.0 to 11.0.15 (11.0.16 is outside it); 12.0.0 (12.0.1 is outside it)
  • CVE-2022-2047
    Affects 7.0.0.M0 to 9.4.46.v20220331 (9.4.47.v20220610 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it); 11.0.0 to 11.0.9 (11.0.10 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 5

  • HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

    Affected: from 12.1.0, fixed in 12.1.7; from 12.0.0, fixed in 12.0.33; from 11.0.0, fixed in 11.0.29; from 10.0.0, fixed in 10.0.28; from 9.4.0, fixed in 9.4.60.

    Fixed in 12.0.33 (released Mar 4, 2026, 41 days before disclosure, the advisory names 9.4.60, which was never published) and 12.1.7 (released Mar 4, 2026, 41 days before disclosure).

    The latest release, 12.1.14, is not affected.

  • The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs.

    Affected: from 9.4.0, through 9.4.58; from 10.0.0, through 10.0.26; from 11.0.0, through 11.0.26; from 12.0.0, fixed in 12.0.31; from 12.1.0, fixed in 12.1.5.

    Fixed in 12.0.31 (released Dec 3, 2025, 92 days before disclosure) and 12.1.5 (released Dec 3, 2025, 92 days before disclosure).

    The latest release, 12.1.14, is not affected.

  • Jetty URI parsing of invalid authority

    Affected: from 7.0.0, through 12.0.11; from 7.0.0, fixed in 12.0.12.

    Fixed in 12.0.12 (released Jul 25, 2024, 81 days before disclosure).

    The latest release, 12.1.14, is not affected.

  • CVE-2023-40167Medium 5.3

    Jetty accepts "+" prefixed value in Content-Length

    Affected: from 9.0.0, fixed in 9.4.52; from 10.0.0, fixed in 10.0.16; from 11.0.0, fixed in 11.0.16; from 12.0.0, fixed in 12.0.1.

    Fixed in 9.4.52.v20230823 (released Aug 23, 2023, 23 days before disclosure, the advisory names 9.4.52, which was never published), 10.0.16 (released Aug 25, 2023, 21 days before disclosure), 11.0.16 (released Aug 25, 2023, 21 days before disclosure) and 1 other version.

    The latest release, 12.1.14, is not affected.

  • In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment…

    Affected: fixed in 9.4.47; from 10.0.0, fixed in 10.0.10; from 11.0.0, fixed in 11.0.10.

    Fixed in 9.4.47.v20220610 (released Jun 10, 2022, 27 days before disclosure, the advisory names 9.4.47, which was never published), 10.0.10 (released Jun 16, 2022, 21 days before disclosure) and 11.0.10 (released Jun 16, 2022, 21 days before disclosure).

    The latest release, 12.1.14, is not affected.