jetty9

3 results · Clear filters · Feed

• High 7.4
  CVE-2026-2332 Public exploit

  HTTP Request Smuggling via Chunked Extension Quoted-String Parsing

  In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.htm…

  Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  Apr 14, 2026
• High 7.5
  CVE-2023-44487 Exploited Public exploit EPSS 100%

  HTTP/2 Stream Cancellation Attack

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

  nodejs go dotnet7 trafficserver Debian Ubuntu Alpine Maven Go SwiftURL
  Oct 10, 2023

  KEV Oct 10, 2023
• High 7.5
  CVE-2021-28165 Public exploit EPSS 54%

  Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

  In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

  The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  Apr 1, 2021