Eclipse Jetty

7 results · Clear filters · Feed

• High 7.5
  CVE-2022-2191

  Jetty SslConnection does not release pooled ByteBuffers in case of errors

  In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

  The Eclipse Foundation Eclipse Jetty org.eclipse.jetty:jetty-server jetty Ubuntu Maven
  Jul 7, 2022
• High 7.5
  CVE-2022-2048

  Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service

  In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario w…

  The Eclipse Foundation Eclipse Jetty jetty9 jenkins Debian Ubuntu Alpine Maven
  Jul 7, 2022
• High 7.5
  CVE-2021-28165 Public exploit EPSS 54%

  Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

  In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

  The Eclipse Foundation Eclipse Jetty jetty9 org.eclipse.jetty:jetty-server Debian Ubuntu Maven
  Apr 1, 2021
• High 7.0
  CVE-2020-27216

  Local Temp Directory Hijacking Vulnerability

  In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory is shared between all users on that system. A collocated user can observe the pr…

  The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  Oct 23, 2020
• High 7.5
  CVE-2018-12545

  Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

  In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additio…

  The Eclipse Foundation Eclipse Jetty org.eclipse.jetty:jetty-server Maven
  Mar 27, 2019
• High 7.5
  CVE-2017-7656

  Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)

  In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a versi…

  The Eclipse Foundation Eclipse Jetty jetty9 jetty9 Debian Ubuntu Maven
  Jun 26, 2018
• High 8.8
  CVE-2018-12538

  Access and integrity issue within Eclipse Jetty

  In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a malicious user to access/hijack other HttpSessions and even delete unmatched HttpSes…

  The Eclipse Foundation Eclipse Jetty org.eclipse.jetty:jetty-server Maven
  Jun 22, 2018