jetty_9.4.31_CVE-2021-34428

Eclipse Jetty Canonical Repository This is the canonical repository for the Jetty project, feel free to fork and contribute now! Submitting a patch or pull request? Make sure you have an Eclipse Contributor Agreement ECA on file. eclipse.org/legal/ecafaq Project description Jetty is a lightweight...

jetty_9.4.31_CVE-2023-26048

Eclipse Jetty Canonical Repository This is the canonical repository for the Jetty project, feel free to fork and contribute now! Submitting a patch or pull request? Make sure you have an Eclipse Contributor Agreement ECA on file. eclipse.org/legal/ecafaq Project description Jetty is a lightweight...

Jetty-v9.4.31_CVE-2023-40167

This repository does not have a README...

-jettyCVE-2021-28164-

-jettyCVE-2021-28164- jetty /CVE-2021-28164/analysis and results...

Jetleak-Testing-Script

Jetleak Testing Script This tool is intended to provide a quick-and-dirty way for organizations to test whether their Jetty web server versions are vulnerable to JetLeak. Currently, this script does not handle sites with invalid SSL certs. This will be fixed in a future iteration. For additional...

CVE-2024-31848-PoC

Exploiting CData within Jetty servers - CVE-2024-31848/49/50/51 - File Path Traversal & File Read What it is A prototype PoC for the automation of vulnerability analysis on targets running CData applications on an embedded Jetty server. Usage Just use -u or --url to specify your target, the scrip...

jetty-line-check

jetty-line-check Which of these six 2026 CVEs has your Jetty or the Jetty pulled in by Spring Boot been hit by — and does the version the official guidance tells you to upgrade to actually exist on Maven Central? The headline is CVE-2026-2332 GHSA-355h-qmc2-wpwf, high / CVSS v3 7.4: chunked reque...

Apache ActiveMQ 6.x < 6.1.2 - Broken Access Control

Apache ActiveMQ 6.x contains an unauthenticated API web context caused by default configuration lacking security measures in the Jetty server, letting anyone interact with broker APIs and messaging layers, exploit requires no authentication. id: CVE-2024-32114 info: name: Apache ActiveMQ 6.x 6.1....

Eclipse Jetty - Information Disclosure

Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224 is susceptible to improper authorization. The default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources within the WEB-INF directory. An attacker can access sensitive information regarding...

CData API Server < 23.4.8844 - Path Traversal

A path traversal vulnerability exists in the Java version of CData API Server 23.4.8844 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain complete administrative access to the application. id: CVE-2024-31848 info: name: CData API Server...

CData Arc < 23.4.8839 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Arc 23.4.8839 when running using the embedded Jetty server, which could allow an unauthenticated remote attacker to gain access to sensitive information and perform limited actions. id: CVE-2024-31850 info: name: CData Arc 23.4.88...

CData Sync < 23.4.8843 - Path Traversal

A path traversal vulnerability exists in the Java version of CData Sync CData - Sync' - r...

Eclipse Jetty - Information Disclosure

Eclipse Jetty 9.4.37-9.4.42, 10.0.1-10.0.5 and 11.0.1-11.0.5 are susceptible to improper authorization. URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. An attacker can potentially obtain sensitive informatio...

Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header. id: CVE-2015-2080 info: name: Eclipse Jetty 9.2.9.v20150224 - Sensitive Information Leakage author: pikpikcu severity: high description: Eclip...

Eclipse Jetty ConcatServlet - Information Disclosure

Eclipse Jetty through 9.4.40, through 10.0.2, and through 11.0.2 is susceptible to information disclosure. Requests to the ConcatServlet with a doubly encoded path can access protected resources within the WEB-INF directory, thus enabling an attacker to potentially obtain sensitive information,...

CLEANSTART-2026-TT31497 client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap

Security vulnerability affects the rundeck package. A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap...

CLEANSTART-2026-VU71113 In Eclipse Jetty, a first HTTP/1

CVE-2026-10051 affects multiple packages. In Eclipse Jetty, a first HTTP/1. See references for individual vulnerability details...

CLEANSTART-2026-RP92768 Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs

Security vulnerability affects the kafka package. The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs...

CLEANSTART-2026-DT46097 In Eclipse Jetty, an HTTP URI of this form: /public;/

CVE-2026-8384 affects multiple packages. In Eclipse Jetty, an HTTP URI of this form: /public;/. See references for individual vulnerability details...

CLEANSTART-2026-JT86822 In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present)

CVE-2026-6790 affects multiple packages. In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority host and port matches what provided in the Host header if present. See references for individual vulnerability details...