5192 matches found
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Impact The original report: Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state. After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is...
Missing Release of Memory after Effective Lifetime
Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Missing Release of Memory after Effective Lifetime through the request-body read path in HttpConnection.java. An attacker can...
GHSA-9299-C6M4-MJHC Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Impact The original report: Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state. After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is...
ai.konduit.serving:konduit-serving-common-tests (0.3.0), app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2025.04.04.113522-414f675) +723 more potentially affected by CVE-2024-7708 via org.eclipse.jetty:jetty-server (>=10.0.7, <=10.0.22)
org.eclipse.jetty:jetty-server MAVEN version =10.0.7, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221128.2102-bdd85b6, =0.1.4-20221128.2102-bdd85b6, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.6.0, =6.4.0, =6.4.0, =6.10.5 and more Source...
be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), ch.exense.rtm:rtm (3.0.0) +1073 more potentially affected by CVE-2024-7708 via org.eclipse.jetty:jetty-server (>=11.0.7, <=11.0.22)
org.eclipse.jetty:jetty-server MAVEN version =11.0.7, =4.0.0-beta.1, =3.24.1, =3.24.1, =3.24.1, =3.27.0, =3.27.0, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.26.0, =3.26.0, =3.23.0, =3.24.0 and more Source cves: CVE-2024-7708 Source advisory: GHSA-9299-C6M4-MJHC...
be.tomcools:dropwizard-websocket-jsr356-bundle (>=4.0.0-beta.1, <=4.0.0), ch.exense.rtm:rtm (3.0.0) +1073 more potentially affected by CVE-2024-7708 via org.eclipse.jetty:jetty-server (>=11.0.7, <=11.0.22)
org.eclipse.jetty:jetty-server MAVEN version =11.0.7, =4.0.0-beta.1, =3.24.1, =3.24.1, =3.24.1, =3.27.0, =3.27.0, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.26.0, =3.26.0, =3.23.0, =3.24.0 and more Source cves: CVE-2024-7708 Source advisory: OSV:GHSA-9299-C6M4-MJHC...
Eclipse Jetty: Path parameter traversal
Description as reported Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot segment. A minimal example is: /public;/../admin/secret In my local reproduction,...
Use of Non-Canonical URL Paths for Authorization Decisions
Overview org.eclipse.jetty:jetty-util is a Web Container & Clients - supports HTTP/2, HTTP/1.1, HTTP/1.0, websocket, servlets, and more. Affected versions of this package are vulnerable to Use of Non-Canonical URL Paths for Authorization Decisions due to incorrect handling of ; path-parameter...
EUVD-2026-43647
Eclipse Jetty: Path parameter traversal...
GHSA-W7X5-G22V-XQHR Eclipse Jetty: Path parameter traversal
Description as reported Summary In Jetty 12.1.8, org.eclipse.jetty.util.URIUtil.canonicalPath may leave dot-dot path segments unnormalized when a semicolon path parameter marker is followed by a slash and a dot segment. A minimal example is: /public;/../admin/secret In my local reproduction,...
Eclipse Jetty: HTTP Authority/Host mismatch
Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...
GHSA-7P3P-8QV8-M2VH Eclipse Jetty: HTTP Authority/Host mismatch
Summary Jetty currently accepts HTTP/2 and HTTP/3 requests where the regular Host header and the pseudo-header :authority do not match. As a result, the same request can carry two different host identities through Jetty: - logic based on HttpURI / Request.getServerNamerequest uses :authority -...
Improper Validation of Consistency within Input
Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Improper Validation of Consistency within Input through ComplianceUtils.verifyHttpURI, HttpFields, HttpCompliance,...
ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +7848 more potentially affected by CVE-2026-6790 via org.eclipse.jetty:jetty-server (>=9.4.0.v20161208, <=9.4.58.v20250814)
org.eclipse.jetty:jetty-server MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.1.7, =0.1.7, =3.30.0.7, =3.30.0.7, =3.38.0.1, =3.42.0.4 and more Source cves: CVE-2026-6790 Source advisory: OSV:GHSA-7P3P-8QV8-M2VH...
ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +1753 more potentially affected by CVE-2026-6790 via org.eclipse.jetty:jetty-server (>=12.1.0, <=12.1.8)
org.eclipse.jetty:jetty-server MAVEN version =12.1.0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =0.1.7, =4.13.5, =4.9.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.1 and more Source cves: CVE-2026-6790 Source advisory: OSV:GHSA-7P3P-8QV8-M2VH...
ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +7848 more potentially affected by CVE-2026-6790 via org.eclipse.jetty:jetty-server (>=9.4.0.v20161208, <=9.4.58.v20250814)
org.eclipse.jetty:jetty-server MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.1.7, =0.1.7, =3.30.0.7, =3.30.0.7, =3.38.0.1, =3.42.0.4 and more Source cves: CVE-2026-6790 Source advisory: GHSA-7P3P-8QV8-M2VH...
ai.konduit.serving:konduit-serving-common-tests (0.3.0), app.cash.backfila:client-misk (>=0.1.4-20221221.1702-8b7db03, <=2026.10.01.201111-ad9f619) +793 more potentially affected by CVE-2026-6790 via org.eclipse.jetty:jetty-server (>=10.0.0, <=10.0.26)
org.eclipse.jetty:jetty-server MAVEN version =10.0.0, =0.1.4-20221221.1702-8b7db03, =0.1.4-20221221.1702-8b7db03, =2023.06.07.114626-93b9d6f, =0.1.4-20221128.2102-bdd85b6, =0.1.4-20221128.2102-bdd85b6, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.4.0, =6.6.0, =6.4.0, =6.4.0, =6.10.5 and more Source...
ai.pipestream:pipestream-wiremock-server (>=0.1.1, <=0.1.6), ai.timefold.solver.enterprise:timefold-solver-enterprise-service-test (2.8.0-rc-1) +1459 more potentially affected by CVE-2026-6790 via org.eclipse.jetty:jetty-server (>=11.0.0, <=11.0.26)
org.eclipse.jetty:jetty-server MAVEN version =11.0.0, =0.1.1, =2.2.0, =0.1.6, =4.0.0-beta.1, =0.1.0-rc, =3.24.1, =3.24.1, =3.24.1, =3.27.0, =3.27.0, =3.24.1, =3.24.1, =3.24.1, =3.29.5 and more Source cves: CVE-2026-6790 Source advisory: OSV:GHSA-7P3P-8QV8-M2VH...
ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10), ai.catboost:catboost-spark_3.2_2.13 (>=1.0.6, <=1.2.10) +7848 more potentially affected by CVE-2026-6790 via org.eclipse.jetty:jetty-server (>=9.4.0.v20161208, <=9.4.58.v20250814)
org.eclipse.jetty:jetty-server MAVEN version =9.4.0.v20161208, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.1.7, =0.1.7, =3.30.0.7, =3.30.0.7, =3.38.0.1, =3.42.0.4 and more Source cves: CVE-2026-6790 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-18230908...