High 1 exploited CVE DLA-3641-1 3 CVEs

jetty9 - security update

Published Oct 30, 2023 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

Release	Package	Fixed in
Debian · 10	jetty9	9.4.50-4+deb10u1

Vulnerabilities 3

High 7.5

CVE-2023-44487 Exploited Public exploit EPSS 100%

HTTP/2 Stream Cancellation Attack

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL

Oct 10, 2023
KEV Oct 10, 2023
High 7.5

CVE-2023-36478

HTTP/2 HPACK integer overflow and buffer allocation

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limi…

Eclipse Foundation jetty.project jetty9 jetty Debian Ubuntu Alpine Maven

Oct 10, 2023
Medium 4.8

CVE-2020-27218

Buffer not correctly recycled in Gzip Request inflation

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacke…

The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven

Nov 28, 2020