Skip to content
OpenAdvisories

Package · Ubuntu

jetty9

38 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Medium 5.3
    CVE-2023-40167 Public exploit

    Jetty accepts "+" prefixed value in Content-Length

    Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…

    Eclipse Foundation jetty.project druid cassandra-reaper Debian Ubuntu Wolfi Maven
  • Medium 5.3
    CVE-2021-34429 Public exploit Scanner template EPSS 99%

    Encoded URIs can access WEB-INF directory in Eclipse Jetty

    For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reporte…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  • Medium 5.2
    CVE-2020-27223 Public exploit EPSS 78%

    DOS vulnerability for Quoted Quality CSV headers

    In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due…

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven