org.eclipse.jetty.demos:demo-proxy-webapp (>=10.0.0.beta2, <=10.0.26), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0.beta2, <=10.0.26) +4 more potentially affected by CVE-2026-18660 via org.eclipse.jetty:jetty-proxy (>=10.0.0-alpha0, <=10.0.26)

org.eclipse.jetty:jetty-proxy MAVEN version =10.0.0-alpha0, =10.0.0.beta2, =10.0.0.beta2, =10.0.0-alpha0, =10.0.0-alpha0, =10.0.10, =5.26.1, =5.27.15 Source cves: CVE-2026-18660 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-21243591...

com.google.appengine:appengine-java-sdk (>=5.0.0, <=5.2.0-beta), com.google.appengine:jetty121-assembly (>=3.0.0-beta, <=5.2.0-beta) +3 more potentially affected by CVE-2026-19863 via org.eclipse.jetty:jetty-ethereum (>=12.1.0.alpha0, <=12.1.12)

org.eclipse.jetty:jetty-ethereum MAVEN version =12.1.0.alpha0, =5.0.0, =3.0.0-beta, =12.1.0.alpha0, =12.1.0.alpha0, =0.3.1, =0.4.0 Source cves: CVE-2026-19863 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-21243549...

com.google.appengine:appengine-java-sdk (>=5.0.0, <=5.2.0-beta), com.google.appengine:jetty121-assembly (>=3.0.0-beta, <=5.2.0-beta) +3 more potentially affected by CVE-2026-19863 via org.eclipse.jetty:jetty-ethereum (>=12.1.0, <=12.1.12)

org.eclipse.jetty:jetty-ethereum MAVEN version =12.1.0, =5.0.0, =3.0.0-beta, =12.1.0, =12.1.0, =0.3.1, =0.4.0 Source cves: CVE-2026-19863 Source advisory: MEND:CVE-2026-19863...

org.eclipse.jetty.demos:demo-proxy-webapp (>=10.0.0, <=10.0.26), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.26) +4 more potentially affected by CVE-2026-18660 via org.eclipse.jetty:jetty-proxy (>=10.0.0, <=10.0.26)

org.eclipse.jetty:jetty-proxy MAVEN version =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.10, =5.26.1, =5.27.15 Source cves: CVE-2026-18660 Source advisory: MEND:CVE-2026-18660...

com.google.appengine:jetty12-assembly (>=2.0.20, <=2.0.21), org.eclipse.jetty.ee9.demos:jetty-ee9-demo-embedded (>=12.0.0, <=12.0.2) +3 more potentially affected by CVE-2024-9823 via org.eclipse.jetty.ee9:jetty-ee9-servlets (>=12.0.0, <=12.0.2)

org.eclipse.jetty.ee9:jetty-ee9-servlets MAVEN version =12.0.0, =2.0.20, =12.0.0, =12.0.0, =12.0.0, =12.0.0, =12.0.2 Source cves: CVE-2024-9823 Source advisory: OSV:GHSA-J26W-F9RQ-MR2Q...

org.eclipse.jetty.documentation:jetty-documentation (>=10.0.8, <=10.0.19), org.eclipse.jetty.http3:http3-client (>=10.0.8, <=10.0.19) +5 more potentially affected by CVE-2024-22201 via org.eclipse.jetty.http3:http3-common (>=10.0.8, <=10.0.19)

org.eclipse.jetty.http3:http3-common MAVEN version =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.10, =5.26.1, =5.27.4 Source cves: CVE-2024-22201 Source advisory: GHSA-RGGV-CV7R-MW98...

org.eclipse.jetty.documentation:jetty-documentation (>=10.0.8, <=10.0.19), org.eclipse.jetty.http3:http3-client (>=10.0.8, <=10.0.19) +5 more potentially affected by CVE-2024-22201 via org.eclipse.jetty.http3:http3-common (>=10.0.8, <=10.0.19)

org.eclipse.jetty.http3:http3-common MAVEN version =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.8, =10.0.10, =5.26.1, =5.27.4 Source cves: CVE-2024-22201 Source advisory: MEND:CVE-2024-22201...

org.eclipse.jetty:jetty-home (>=9.4.21.v20190926, <=9.4.51.v20230217), org.openl.rules.demo:openl-demo-app (5.26.0) potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (>=9.4.21.v20190926, <=9.4.51.v20230217)

org.eclipse.jetty:jetty-openid MAVEN version =9.4.21.v20190926, =9.4.21.v20190926, =9.4.51.v20230217 - org.openl.rules.demo:openl-demo-app 5.26.0 Source cves: CVE-2023-41900 Source advisory: MEND:CVE-2023-41900...

org.eclipse.jetty:jetty-home (>=9.4.21.v20190926, <=9.4.50.v20221201), org.openl.rules.demo:openl-demo-app (5.26.0) potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (>=9.4.21.v20190926, <=9.4.50.v20221201)

org.eclipse.jetty:jetty-openid MAVEN version =9.4.21.v20190926, =9.4.21.v20190926, =9.4.50.v20221201 - org.openl.rules.demo:openl-demo-app 5.26.0 Source cves: CVE-2023-41900 Source advisory: GHSA-PWH8-58VV-VW48...

org.eclipse.jetty:jetty-home (>=9.4.21.v20190926, <=9.4.51.v20230217), org.openl.rules.demo:openl-demo-app (5.26.0) potentially affected by CVE-2023-41900 via org.eclipse.jetty:jetty-openid (>=9.4.21.v20190926, <=9.4.51.v20230217)

org.eclipse.jetty:jetty-openid MAVEN version =9.4.21.v20190926, =9.4.21.v20190926, =9.4.51.v20230217 - org.openl.rules.demo:openl-demo-app 5.26.0 Source cves: CVE-2023-41900 Source advisory: OSV:GHSA-PWH8-58VV-VW48...

org.eclipse.jetty.documentation:jetty-documentation (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee10.demos:jetty-ee10-demo-embedded (>=12.0.0.alpha0, <=12.0.0.beta1) +4 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee10:jetty-ee10-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee10:jetty-ee10-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: GHSA-3GH6-V5V9-6V9J...

org.eclipse.jetty.ee9.demos:jetty-ee9-demo-embedded (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee9.demos:jetty-ee9-demo-jetty-webapp (>=12.0.0.alpha0, <=12.0.0.beta1) +3 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee9:jetty-ee9-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee9:jetty-ee9-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: GHSA-3GH6-V5V9-6V9J...

org.eclipse.jetty.ee9.demos:jetty-ee9-demo-embedded (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee9.demos:jetty-ee9-demo-jetty-webapp (>=12.0.0.alpha0, <=12.0.0.beta1) +3 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee9:jetty-ee9-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee9:jetty-ee9-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: OSV:GHSA-3GH6-V5V9-6V9J...

org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee8:jetty-ee8-home (>=12.0.0.alpha0, <=12.0.0.beta1) +1 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee8:jetty-ee8-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee8:jetty-ee8-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: GHSA-3GH6-V5V9-6V9J...

org.eclipse.jetty.ee8.demos:jetty-ee8-demo-jetty-webapp (>=12.0.0.alpha0, <=12.0.0.beta1), org.eclipse.jetty.ee8:jetty-ee8-home (>=12.0.0.alpha0, <=12.0.0.beta1) +1 more potentially affected by CVE-2023-36479 via org.eclipse.jetty.ee8:jetty-ee8-servlets (>=12.0.0.alpha0, <=12.0.0.beta1)

org.eclipse.jetty.ee8:jetty-ee8-servlets MAVEN version =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.alpha0, =12.0.0.beta1 Source cves: CVE-2023-36479 Source advisory: OSV:GHSA-3GH6-V5V9-6V9J...

Jetty SslConnection does not release pooled ByteBuffers in case of errors

Impact SslConnection does not release ByteBuffers in case of error code paths. For example, TLS handshakes that require client-auth with clients that send expired certificates will trigger a TLS handshake errors and the ByteBuffers used to process the TLS handshake will be leaked. Workarounds...

org.codehaus.cargo:cargo-jetty-11-deployer (>=1.10.9, <=1.10.29), org.codehaus.cargo:cargo-jetty-11-onwards-deployer (>=1.8.3, <=1.10.8) +5 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =11.0.0, =1.10.9, =1.8.3, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.1 Source cves: CVE-2021-28163 Source advisory: OSV:GHSA-J6QJ-J888-VVGQ...

org.codehaus.cargo:cargo-jetty-10-deployer (>=1.8.3, <=1.10.29), org.eclipse.jetty.demos:demos-jetty-embedded (>=10.0.0, <=10.0.1) +4 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=10.0.0, <=10.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =10.0.0, =1.8.3, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.0, =10.0.1 Source cves: CVE-2021-28163 Source advisory: MEND:CVE-2021-28163...

org.codehaus.cargo:cargo-jetty-11-deployer (>=1.10.9, <=1.10.29), org.codehaus.cargo:cargo-jetty-11-onwards-deployer (>=1.8.3, <=1.10.8) +5 more potentially affected by CVE-2021-28163 via org.eclipse.jetty:jetty-deploy (>=11.0.0, <=11.0.1)

org.eclipse.jetty:jetty-deploy MAVEN version =11.0.0, =1.10.9, =1.8.3, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.0, =11.0.1 Source cves: CVE-2021-28163 Source advisory: MEND:CVE-2021-28163...