Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.eclipse.jetty:jetty-server

29 known vulnerabilities (5 high, 5 medium, 2 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
29 · 5 high, 5 medium, 2 low
Dependents
420
Registry
Maven Central

Advisories 29

  • For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.

    Affected: from 10.0.7, fixed in 10.0.23; from 11.0.7, fixed in 11.0.23.

  • CVE-2026-6790Medium 5.3

    In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what…

    Affected: from 9.4.0.v20161208, through 9.4.58.v20250814; from 10.0.0, through 10.0.26; from 11.0.0, through 11.0.26; from 12.0.0, fixed in 12.0.35; from 12.1.0, fixed in 12.1.9.

  • CVE-2026-10051Medium 6.9

    In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over…

    Affected: from 12.0.0, fixed in 12.0.36; from 12.1.0, fixed in 12.1.10.

  • In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request…

    Affected: from 12.1.0, fixed in 12.1.6; from 12.0.0, fixed in 12.0.32.

  • Eclipse Jetty GZIP buffer release

    Affected: from 9.4.0, fixed in 9.4.57.v20241219.

  • CVE-2024-8184Medium 5.9

    Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

    Affected: from 9.3.12, through 9.4.55; from 10.0.0, through 10.0.23; from 11.0.0, through 11.0.23; from 12.0.0, through 12.0.8; from 12.0.0, fixed in 12.0.9; from 10.0.0, fixed in 10.0.24; from 11.0.0, fixed in 11.0.24; from 9.3.12, fixed in 9.4.56.

  • Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

    Affected: fixed in 9.4.51.v20230217; from 10.0.0, fixed in 10.0.14; from 11.0.0, fixed in 11.0.14; from 12.0.0alpha0, fixed in 12.0.0.beta0.

  • CVE-2023-26048Medium 5.3

    OutOfMemoryError for large multipart without filename in Eclipse Jetty

    Affected: fixed in 9.4.51.v20230217; from 10.0.0, fixed in 10.0.14; from 11.0.0, fixed in 11.0.14.

  • In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured…

    Affected: from 10.0.0, fixed in 10.0.10; from 11.0.0, fixed in 11.0.10.

  • For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method…

    Affected: fixed in 9.4.41; from 10.0.0, fixed in 10.0.3; from 11.0.0, fixed in 11.0.3.

  • In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large…

    Affected: from 7.2.2, fixed in 9.4.39; from 10.0.0, fixed in 10.0.2; from 11.0.0, fixed in 11.0.2.

  • CVE-2020-27223Medium 5.2

    In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple…

    Affected: from 9.4.6, fixed in 9.4.37; from 10.0.0, fixed in 10.0.1; from 11.0.0, fixed in 11.0.1.

  • In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request…

    Affected: from 9.4.0, fixed in 9.4.35.v20201120.

  • In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to…

    Affected: from 9.4.27, fixed in 9.4.30.v20200611.

  • In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response…

    Affected: from 9.4.21.v20190926, fixed in 9.4.24.v20191120; from 9.4.22.v20191022, fixed in 9.4.24.v20191120; from 9.4.23.v20191118, fixed in 9.4.24.v20191120.

Show all 29 advisoriesShow fewer advisories

  • In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty…

    Affected: from 7.0.0, fixed in 9.2.28.v20190418; from 9.3.0, fixed in 9.3.27.v20190418; from 9.4.0, fixed in 9.4.17.v20190418.

  • In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base…

    Affected: from 9.2.0, fixed in 9.2.28.v20190418; from 9.3.0, fixed in 9.3.27.v20190418; from 9.4.0, fixed in 9.4.17.v20190418.

  • In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote…

    Affected: fixed in 9.2.27.v20190403; from 9.3.0, fixed in 9.3.26.v20190403; from 9.4.0, fixed in 9.4.16.v20190411.

  • In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large…

    Affected: from 9.4.0, fixed in 9.4.12.v20180830; from 9.3.0, fixed in 9.3.25.v20180904.

  • In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that…

    Affected: from 9.4.0, fixed in 9.4.11.v20180605; from 9.0.0, fixed in 9.3.24.v20180605.

  • In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when…

    Affected: fixed in 9.2.25.v20180606; from 9.3.0, fixed in 9.3.24.v20180605; from 9.4.0, fixed in 9.4.11.v20180605.

  • In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance…

    Affected: fixed in 9.2.25.v20180606; from 9.3.0, fixed in 9.3.24.v20180605.

  • In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance…

    Affected: fixed in 9.3.24.v20180605; from 9.4.0, fixed in 9.4.11.v20180605.

  • In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of…

    Affected: from 9.4.0, fixed in 9.4.11.v20180605.

  • Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain…

    Affected: from 9.4.0, fixed in 9.4.6.v20170531; from 9.3.0, fixed in 9.3.20.v20170531; fixed in 9.2.22.v20170606.

  • The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass…

    Affected: from 9.3.0, fixed in 9.3.9.

  • The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process…

    Affected: fixed in 9.2.9.v20150224.

  • Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions…

    Affected: fixed in 8.1.0.RC4.

  • Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using…

    Affected: fixed in 4.2.27; from 5.1.0, fixed in 5.1.12; from 6.0.0, fixed in 6.0.2; from 6.1.0pre1, fixed in 6.1.0pre3.