# org.eclipse.jetty:jetty-server (Maven) vulnerabilities 29 known vulnerabilities (5 high, 5 medium, 2 low), with the versions each affects and the releases that fix them. ## At a glance - Latest release: not known (cve.now hasn't read this package's releases) - Newest unaffected release: not known without release data - Dependents: 420 - Registry: https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-server ## Advisories (29) ### [CVE-2024-7708](https://cve.now/CVE-2024-7708): For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. - Severity: High 7.5 - Published: Jul 14, 2026 - Affected: from 10.0.7, fixed in 10.0.23; from 11.0.7, fixed in 11.0.23. ### [CVE-2026-6790](https://cve.now/CVE-2026-6790): In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what… - Severity: Medium 5.3 - Published: Jul 14, 2026 - Affected: from 9.4.0.v20161208, through 9.4.58.v20250814; from 10.0.0, through 10.0.26; from 11.0.0, through 11.0.26; from 12.0.0, fixed in 12.0.35; from 12.1.0, fixed in 12.1.9. ### [CVE-2026-10051](https://cve.now/CVE-2026-10051): In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over… - Severity: Medium 6.9 - Published: Jul 14, 2026 - Affected: from 12.0.0, fixed in 12.0.36; from 12.1.0, fixed in 12.1.10. ### [CVE-2026-1605](https://cve.now/CVE-2026-1605): In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request… - Severity: High 7.5 - Published: Mar 5, 2026 - Affected: from 12.1.0, fixed in 12.1.6; from 12.0.0, fixed in 12.0.32. ### [CVE-2024-13009](https://cve.now/CVE-2024-13009): Eclipse Jetty GZIP buffer release - Severity: High 7.2 - Published: May 8, 2025 - Affected: from 9.4.0, fixed in 9.4.57.v20241219. ### [CVE-2024-8184](https://cve.now/CVE-2024-8184): Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks - Severity: Medium 5.9 - Published: Oct 14, 2024 - Affected: from 9.3.12, through 9.4.55; from 10.0.0, through 10.0.23; from 11.0.0, through 11.0.23; from 12.0.0, through 12.0.8; from 12.0.0, fixed in 12.0.9; from 10.0.0, fixed in 10.0.24; from 11.0.0, fixed in 11.0.24; from 9.3.12, fixed in 9.4.56. ### [CVE-2023-26049](https://cve.now/CVE-2023-26049): Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty - Severity: Low 2.4 - Published: Apr 18, 2023 - Affected: fixed in 9.4.51.v20230217; from 10.0.0, fixed in 10.0.14; from 11.0.0, fixed in 11.0.14; from 12.0.0alpha0, fixed in 12.0.0.beta0. ### [CVE-2023-26048](https://cve.now/CVE-2023-26048): OutOfMemoryError for large multipart without filename in Eclipse Jetty - Severity: Medium 5.3 - Published: Apr 18, 2023 - Affected: fixed in 9.4.51.v20230217; from 10.0.0, fixed in 10.0.14; from 11.0.0, fixed in 11.0.14. ### [CVE-2022-2191](https://cve.now/CVE-2022-2191): In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured… - Severity: High 7.5 - Published: Jul 7, 2022 - Affected: from 10.0.0, fixed in 10.0.10; from 11.0.0, fixed in 11.0.10. ### [CVE-2021-34428](https://cve.now/CVE-2021-34428): For Eclipse Jetty versions \<= 9.4.40, \<= 10.0.2, \<= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method… - Severity: Low 2.9 - Published: Jun 22, 2021 - Affected: fixed in 9.4.41; from 10.0.0, fixed in 10.0.3; from 11.0.0, fixed in 11.0.3. ### [CVE-2021-28165](https://cve.now/CVE-2021-28165): In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large… - Severity: High 7.5 - Published: Apr 1, 2021 - Affected: from 7.2.2, fixed in 9.4.39; from 10.0.0, fixed in 10.0.2; from 11.0.0, fixed in 11.0.2. ### [CVE-2020-27223](https://cve.now/CVE-2020-27223): In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple… - Severity: Medium 5.2 - Published: Feb 26, 2021 - Affected: from 9.4.6, fixed in 9.4.37; from 10.0.0, fixed in 10.0.1; from 11.0.0, fixed in 11.0.1. ### [CVE-2020-27218](https://cve.now/CVE-2020-27218): In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request… - Severity: Unrated - Published: Nov 28, 2020 - Affected: from 9.4.0, fixed in 9.4.35.v20201120. ### [CVE-2019-17638](https://cve.now/CVE-2019-17638): In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to… - Severity: Unrated - Published: Jul 9, 2020 - Affected: from 9.4.27, fixed in 9.4.30.v20200611. ### [CVE-2019-17632](https://cve.now/CVE-2019-17632): In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response… - Severity: Unrated - Published: Nov 25, 2019 - Affected: from 9.4.21.v20190926, fixed in 9.4.24.v20191120; from 9.4.22.v20191022, fixed in 9.4.24.v20191120; from 9.4.23.v20191118, fixed in 9.4.24.v20191120. ### [CVE-2019-10247](https://cve.now/CVE-2019-10247): In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty… - Severity: Unrated - Published: Apr 22, 2019 - Affected: from 7.0.0, fixed in 9.2.28.v20190418; from 9.3.0, fixed in 9.3.27.v20190418; from 9.4.0, fixed in 9.4.17.v20190418. ### [CVE-2019-10246](https://cve.now/CVE-2019-10246): In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base… - Severity: Unrated - Published: Apr 22, 2019 - Affected: from 9.2.0, fixed in 9.2.28.v20190418; from 9.3.0, fixed in 9.3.27.v20190418; from 9.4.0, fixed in 9.4.17.v20190418. ### [CVE-2019-10241](https://cve.now/CVE-2019-10241): In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote… - Severity: Unrated - Published: Apr 22, 2019 - Affected: fixed in 9.2.27.v20190403; from 9.3.0, fixed in 9.3.26.v20190403; from 9.4.0, fixed in 9.4.16.v20190411. ### [CVE-2018-12545](https://cve.now/CVE-2018-12545): In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large… - Severity: Unrated - Published: Mar 27, 2019 - Affected: from 9.4.0, fixed in 9.4.12.v20180830; from 9.3.0, fixed in 9.3.25.v20180904. ### [CVE-2018-12536](https://cve.now/CVE-2018-12536): In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that… - Severity: Unrated - Published: Jun 27, 2018 - Affected: from 9.4.0, fixed in 9.4.11.v20180605; from 9.0.0, fixed in 9.3.24.v20180605. ### [CVE-2017-7658](https://cve.now/CVE-2017-7658): In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when… - Severity: Unrated - Published: Jun 26, 2018 - Affected: fixed in 9.2.25.v20180606; from 9.3.0, fixed in 9.3.24.v20180605; from 9.4.0, fixed in 9.4.11.v20180605. ### [CVE-2017-7657](https://cve.now/CVE-2017-7657): In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance… - Severity: Unrated - Published: Jun 26, 2018 - Affected: fixed in 9.2.25.v20180606; from 9.3.0, fixed in 9.3.24.v20180605. ### [CVE-2017-7656](https://cve.now/CVE-2017-7656): In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance… - Severity: Unrated - Published: Jun 26, 2018 - Affected: fixed in 9.3.24.v20180605; from 9.4.0, fixed in 9.4.11.v20180605. ### [CVE-2018-12538](https://cve.now/CVE-2018-12538): In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of… - Severity: Unrated - Published: Jun 22, 2018 - Affected: from 9.4.0, fixed in 9.4.11.v20180605. ### [CVE-2017-9735](https://cve.now/CVE-2017-9735): Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain… - Severity: Unrated - Published: Jun 16, 2017 - Affected: from 9.4.0, fixed in 9.4.6.v20170531; from 9.3.0, fixed in 9.3.20.v20170531; fixed in 9.2.22.v20170606. ### [CVE-2016-4800](https://cve.now/CVE-2016-4800): The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass… - Severity: Unrated - Published: Apr 13, 2017 - Affected: from 9.3.0, fixed in 9.3.9. ### [CVE-2015-2080](https://cve.now/CVE-2015-2080): The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process… - Severity: Unrated - Published: Oct 7, 2016 - Affected: fixed in 9.2.9.v20150224. ### [CVE-2011-4461](https://cve.now/CVE-2011-4461): Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions… - Severity: Unrated - Published: Dec 30, 2011 - Affected: fixed in 8.1.0.RC4. ### [CVE-2006-6969](https://cve.now/CVE-2006-6969): Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using… - Severity: Unrated - Published: Feb 7, 2007 - Affected: fixed in 4.2.27; from 5.1.0, fixed in 5.1.12; from 6.0.0, fixed in 6.0.2; from 6.1.0pre1, fixed in 6.1.0pre3. --- Source: cve.now Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards. Page: https://cve.now/packages/maven/org.eclipse.jetty:jetty-server Site guide for agents: https://cve.now/llms.txt Uses NVD data; not endorsed by NVD.