The vulnerability of Eclipse Jetty servlet containers relates to improper cleaning or release of resources, allowing attackers to circumvent established security restrictions.

🗓️ 17 Jul 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Jetty servlet containers have a flaw from improper resource cleanup that allows remote attackers to bypass security restrictions.

Reporter	Title	Published	Views	Family All 95
IBM Security Bulletins	Security Bulletin: Due to use of jetty-server IBM webMethods BPM is vulnerable to corrupted and/or inadvertent sharing of data between requests	12 Nov 202509:50	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	27 Mar 202608:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues	28 Aug 202505:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues	28 Aug 202505:55	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerabilities in Eclipse affect Tivoli Netcool/OMNIbus. (CVE-2024-13009, CVE-2024-47554)	27 Nov 202513:15	–	ibm
IBM Security Bulletins	Security Bulletin: User Entity Behavior Analytics App for IBM QRadar SIEM is vulnerable to using components with known vulnerabilities	28 Jan 202615:35	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis is affected by denial of service (DoS), server-side request forgery (SSRF) protections, leak or corrupt request data, and security by-pass due to the use of Eclipse Jetty	6 Apr 202617:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM DevOps Deploy / IBM UrbanCode Deploy (UCD) is susceptible to an Improper Resource Shutdown or Release in Eclipse Jetty (CVE-2024-13009)	18 Jun 202519:45	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse Jetty web server library that could lead to request data corruption or leakage between sessions (CVE-2024-13009).	27 Mar 202600:47	–	ibm
IBM Security Bulletins	Security Bulletin: In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body, which affects IBM watsonx.data	1 Sep 202514:53	–	ibm

Vulners

Node

red_hat a-mq_clientsMatch2

novell suse_enterprise_storageMatch7.1

eclipse jettyRange9.4.0–9.4.56

red_hat red_hat_build_of_apache_camel_for_spring_bootMatch4.10.3

red_hat streams_for_apache_kafkaMatch3

red_hat streams_for_apache_kafkaMatch2.9.1

google android_studioMatch2025.2.3.9

gradle gradleMatch8.14.3

fedora fedoraMatch41

novell opensuse_leapMatch15.6

fedora fedoraMatch42

Source	Link
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
gitlab	www.gitlab.eclipse.org/security/cve-assignement/-/issues/48
repo	www.repo.red-soft.ru/redos/8.0/x86_64/updates/
security-tracker	www.security-tracker.debian.org/tracker/CVE-2024-13009
access	www.access.redhat.com/security/cve/CVE-2024-13009
suse	www.suse.com/security/cve/CVE-2024-13009.html
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
web	www.web.nvd.nist.gov/view/vuln/detail

10 Feb 2026 00:00Current

6.4Medium risk

Vulners AI Score6.4

CVSS 26.4

CVSS 37.2

EPSS0.00432