Skip to content
OpenAdvisories

Package · Maven

org.eclipse.jetty:jetty-http

5 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

1 result · Clear filters · Feed

  • Medium 5.3
    CVE-2023-40167 Public exploit

    Jetty accepts "+" prefixed value in Content-Length

    Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…

    Eclipse Foundation jetty.project druid cassandra-reaper Debian Ubuntu Wolfi Maven