The vulnerability of the HttpURI class in Eclipse Jetty’s server container allows a attacker to perform an SSRF attack.

🗓️ 22 Nov 2024 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

bdu_fstec

bdu_fstec🔗 bdu.fstec.ru👁 2 Views

The HttpURI class in Eclipse Jetty server container has improper syntax validation enabling remote SSRF attacks.

Reporter	Title	Published	Views	Family All 317
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in IBM Application Performance Management	9 Jan 202510:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for December 2025 - Multiple CVEs addressed	29 Jan 202607:37	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Cloud Pak for Business Automation iFixes for February 2025.	13 Mar 202616:55	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of Eclipse Jetty, IBM App Connect Professional is vulnerable to bypass security restrictions	10 Jan 202508:15	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to denial-of-service due to Jetty	1 May 202607:38	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of jetty-server IBM webMethods BPM is vulnerable to corrupted and/or inadvertent sharing of data between requests	12 Nov 202509:50	–	ibm
IBM Security Bulletins	Security Bulletin: DataStage on Cloud Pak for Data is vulnerable to an open redirect attack due to the Eclipse Jetty package (CVE-2024-6763)	6 Oct 202521:58	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Security Center is affected by multiple vulnerabilities	19 Jun 202505:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is vulnerable due to Eclipse Jetty (CVE-2024-6763)	1 Apr 202503:34	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	27 Mar 202608:06	–	ibm

Vulners

Node

eclipse jettyRange7.0.0–12.0.11

OR

google android_studioMatch2025.2.3.9

Source	Link
gitlab	www.gitlab.eclipse.org/security/cve-assignement/-/issues/25
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh
github	www.github.com/hapifhir/hapi-fhir/issues/6368
redos	www.redos.red-soft.ru/support/secure/uyazvimosti/mnozhestvennye-uyazvimosti-jetty-cve-2024-13009-cve-2024-8184-cve-2024-6762-cve-2024-6763/
web	www.web.nvd.nist.gov/view/vuln/detail

10 Feb 2026 00:00Current

6.3Medium risk

Vulners AI Score6.3

CVSS 25

CVSS 35.3

EPSS0.01189

HttpURI class Eclipse Jetty server side forgery