# org.eclipse.jetty:jetty-webapp (Maven) vulnerabilities

3 known vulnerabilities (2 medium), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 11.0.25 (Mar 13, 2025): no advisory affects it
- Newest unaffected release: 11.0.26 (Aug 14, 2025)
- Dependents: 268
- Releases: 371 since 7.0.0.v20091005 (Oct 5, 2009)
- Registry: https://central.sonatype.com/artifact/org.eclipse.jetty/jetty-webapp
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2021-34429: 9.4.37.v20210219 to 9.4.42.v20210604 (9.4.43.v20210629 is outside it); 10.0.1 to 10.0.5 (10.0.6 is outside it); 11.0.1 to 11.0.5 (11.0.6 is outside it)
- CVE-2021-28164: 9.4.37.v20210219 to 9.4.38.v20210224 (9.4.39.v20210325 is outside it)
- CVE-2020-27216: 7.0.0.M0 to 9.4.32.v20200930 (9.4.33.v20201020 is outside it); 10.0.0.beta1 to 10.0.0.beta2 (10.0.0.beta3 is outside it); 11.0.0.beta1 to 11.0.0.beta2 (11.0.0.beta3 is outside it)

## Advisories (3)

### [CVE-2021-34429](https://cve.now/CVE-2021-34429): For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the…

- Severity: Medium 5.3
- Published: Jul 15, 2021
- Affected: from 9.4.37, fixed in 9.4.43; from 10.0.1, fixed in 10.0.6; from 11.0.1, fixed in 11.0.6.
- Fixed in 9.4.43.v20210629 (released Jun 30, 2021, 15 days before disclosure, the advisory names 9.4.43, which was never published), 10.0.6 (released Jun 29, 2021, 16 days before disclosure) and 11.0.6 (released Jun 29, 2021, 16 days before disclosure).
- The latest release, 11.0.25, is not affected.

### [CVE-2021-28164](https://cve.now/CVE-2021-28164): In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e…

- Severity: Medium 5.3
- Published: Apr 1, 2021
- Affected: from 9.4.37, fixed in 9.4.39.
- Fixed in 9.4.39.v20210325 (released Mar 25, 2021, 7 days before disclosure, the advisory names 9.4.39, which was never published).
- The latest release, 11.0.25, is not affected.

### [CVE-2020-27216](https://cve.now/CVE-2020-27216): In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like…

- Severity: Unrated
- Published: Oct 23, 2020
- Affected: fixed in 9.4.33.v20201020; from 10.0.0.beta1, fixed in 10.0.0.beta3; from 11.0.0.beta1, fixed in 11.0.0.beta3.
- Fixed in 9.4.33.v20201020 (released Oct 20, 2020, 3 days before disclosure), 10.0.0.beta3 (released Oct 21, 2020, 2 days before disclosure) and 11.0.0.beta3 (released Oct 21, 2020, 2 days before disclosure).
- The latest release, 11.0.25, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.eclipse.jetty:jetty-webapp
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.