Skip to content
OpenAdvisories

Product · eclipse

jetty.project

6 known vulnerabilities.

jetty.project at a glance

Last 12 months
0
Critical · all time
0
Exploited · all time
0
Public exploit · all time
3
New vulnerabilities per month · last 12 months
0 1 1 December 2025: 0 vulnerabilities Dec 2025 January 2026: 0 vulnerabilities February 2026: 0 vulnerabilities March 2026: 0 vulnerabilities Mar April 2026: 0 vulnerabilities May 2026: 0 vulnerabilities June 2026: 0 vulnerabilities Jun July 2026: 0 vulnerabilities August 2026: 0 vulnerabilities September 2026: 0 vulnerabilities Sep October 2026: 0 vulnerabilities November 2026: 0 vulnerabilities
Show as table
MonthVulnerabilitiesCritical
Nov 202600
Oct 202600
Sep 202600
Aug 202600
Jul 202600
Jun 202600
May 202600
Apr 202600
Mar 202600
Feb 202600
Jan 202600
Dec 202500
Nov 202500
Oct 202500
Sep 202500
Aug 202500
Jul 202500
Jun 202500
May 202500
Apr 202500
Mar 202500
Feb 202500
Jan 202500
Dec 202400
All Critical High Medium Low Exploited only Public exploit

6 results · Feed

  • High 7.5
    CVE-2023-36478

    HTTP/2 HPACK integer overflow and buffer allocation

    Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limi…

    eclipse jetty.project jetty9 jetty Debian Ubuntu Alpine Maven
  • Low 3.5
    CVE-2023-41900

    Jetty's OpenId Revoked authentication allows one request

    Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty `OpenIdAuthenticator` uses the optional nested `LoginService`, and that `LoginService` decides to revok…

    eclipse jetty.project jetty9 jetty9 Debian Ubuntu Maven
  • Medium 5.3
    CVE-2023-40167 Public exploit

    Jetty accepts "+" prefixed value in Content-Length

    Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and othe…

    eclipse jetty.project jetty9 jetty9 Debian Ubuntu Maven
  • Low 3.5
    CVE-2023-36479

    Jetty vulnerable to errant command quoting in CGI Servlet

    Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for…

    eclipse jetty.project jetty9 jetty Debian Ubuntu Maven
  • Low 2.4
    CVE-2023-26049 Public exploit

    Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty

    Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a co…

    eclipse jetty.project jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  • Medium 5.3
    CVE-2023-26048 Public exploit

    OutOfMemoryError for large multipart without filename in Eclipse Jetty

    Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` wh…

    eclipse jetty.project jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven