Skip to content
OpenAdvisories

Product · The Eclipse Foundation

Eclipse Jetty

23 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

3 results · Clear filters · Feed

  • Critical 9.4
    CVE-2019-17638 Public exploit EPSS 11%

    Operation on a Resource after Expiration or Release in Jetty Server

    In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the Byte…

    The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Maven
  • Critical 9.8
    CVE-2017-7658 EPSS 19%

    Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

    In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked …

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  • Critical 9.8
    CVE-2017-7657 EPSS 14%

    Critical severity vulnerability that affects org.eclipse.jetty:jetty-server

    In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a …

    The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven