61 matches found
ROOT-APP-MAVEN-CVE-2026-2332 CVE-2026-2332 in org.eclipse.jetty:jetty-http - Patched by Root
Root has patched CVE-2026-2332 in the org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available...
Rocky Linux 9 [CIQ] Security Update: jmc Multiple Vulnerabilities (crlsa-2026_20568)
The Rocky Linux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the CIQ crlsa-202620568 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggling via...
Missing Release of Resource after Effective Lifetime
Overview Affected versions of this package are vulnerable to Missing Release of Resource after Effective Lifetime due to a race condition in the server when handling RSTSTREAM and GOAWAY frames. An attacker can cause the server to become unresponsive by sending specially crafted HTTP/2 requests...
HTTP Request Smuggling
Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the chunked request parsing of HttpParser, which accepts a lone LF, rather than CRLF, as the line terminator for chunk extensions, chunk dat...
CVE-2026-12611
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...
CVE-2026-12611
CVE-2026-12611 affects the Eclipse Jetty HTTP/2 server implementation. A client can trigger a race condition in the server's handling of RST_STREAM and GOAWAY frames, which resets HTTP2Flusher.terminated back to null. This allows flusher entries to be enqueued that are never processed, leaving wr...
ROOT-APP-MAVEN-CVE-2025-11143 CVE-2025-11143 in org.eclipse.jetty:jetty-http - Patched by Root
Root has patched CVE-2025-11143 in the org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available...
ROOT-APP-MAVEN-CVE-2024-6763 CVE-2024-6763 in org.eclipse.jetty:jetty-http - Patched by Root
Root has patched CVE-2024-6763 in the org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available...
Inconsistent Interpretation of HTTP Requests at org.eclipse.jetty:jetty-http dependency in Crucible Server
This is a vulnerability in a non-Atlassian Crucible Server dependency. Atlassian's application of this dependency presents a lower, non-critical assessed risk. This Critical severity Inconsistent Interpretation of HTTP Requests vulnerability was introduced in version 4.9.0 of Crucible Server. Thi...
Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to CVE-2026-2332.
Summary IBM Maximo Application Suite - IoT Component uses jetty-http-10.0.26.jar, jetty-http-12.1.5.jar, jetty-http-12.1.6.jar which is vulnerable to CVE-2026-2332. This bulletin contains information regarding the vulnerability and how to address it. Vulnerability Details CVEID:CVE-2026-2332...
Improper Authentication
Jetty HTTP Client is vulnerable to Improper Authentication. The vulnerability is due to the use of ISO-8859-1 encoding when computing Digest authentication response hashes, which replaces all non-Latin-1 characters with ?, allowing an attacker who knows a victim's username to bypass Digest...
jmc security update
An update is available for jmc. This update affects Rocky Linux 9. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the CVE list JDK Mission Control is a powerful profiler for HotSpot JVMs and has an advanced s...
RockyLinux 9 : jmc (RLSA-2026:20568)
The remote RockyLinux 9 host has a package installed that is affected by multiple vulnerabilities as referenced in the RLSA-2026:20568 advisory. lz4-java: lz4-java: Information Disclosure via Insufficient Output Buffer Clearing CVE-2025-66566 org.eclipse.jetty/jetty-http: HTTP request smuggling v...
Vulnerabilities in Oracle Database Server
Oracle has identified vulnerabilities in Oracle REST Data Services versions 24.2.0 to 26.1.0 and Oracle Database Server versions 23.4.0 to 23.26.2. The vulnerabilities in Oracle REST Data Services allow attackers with low privileges and network access via HTTPS to perform various actions without...
Important: Red Hat Security Advisory: jmc security update
An update for jmc is now available for Red Hat Enterprise Linux 9. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System CVSS base score, which gives a detailed severity rating, is available for each vulnerability from the C...
Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in jetty-http (CVE-2025-11143)
Summary IBM Sterling Control Center is affected by a vulnerability CVE-2025-11143 reported for jetty-http-12.0.25.jar. Vulnerability Details CVEID:CVE-2025-11143 DESCRIPTION: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differentia...
Security Bulletin: IBM Guardium Data Protection is affected by a single vulnerability (CVE-2025-5115)
Summary IBM Guardium Data Protection has addressed this vulnerability in an update. Vulnerability Details CVEID:CVE-2025-5115 DESCRIPTION: In Eclipse Jetty, versions =9.4.57, =10.0.25, =11.0.25, =12.0.21, =12.1.0.alpha2, an HTTP/2 client may trigger the server to send RSTSTREAM frames, for exampl...
HTTP Request Smuggling
Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 parser HttpParser.java. An attacker can inject additional HTTP requests with chunked transfer encoding with improperly terminat...
