Description
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| The Eclipse Foundation | Eclipse Jetty | 9.4.0 – < unspecified, unspecified – ≤ 9.4.46, 10.0.0 – < unspecified, unspecified – ≤ 10.0.9, 11.0.0 – < unspecified, unspecified – ≤ 11.0.9 | unspecified |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jetty9 | 9.4.48-1 | — |
| Debian 13 | jetty9 | 9.4.48-1 | — |
| Debian 12 | jetty9 | 9.4.48-1 | — |
| Debian 11 | jetty9 | 9.4.39-3+deb11u1 | DSA-5198-1 |
| Debian 10 | jetty9 | 9.4.16-0+deb10u2 | DLA-3079-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 20.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 18.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 16.04 LTS | jetty +2 | No fix yet | — |
| Ubuntu 14.04 LTS | jetty +1 | No fix yet | — |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | druid | 35.0.1-r1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-http | < 9.4.47 | 9.4.47 | GHSA-cj7v-27pg-wf7q |
| Maven | org.eclipse.jetty:jetty-http | >= 10.0.0, < 10.0.10 | 10.0.10 | GHSA-cj7v-27pg-wf7q |
| Maven | org.eclipse.jetty:jetty-http | >= 11.0.0, < 11.0.10 | 11.0.10 | GHSA-cj7v-27pg-wf7q |
Advisories 7
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- DSA-5198-1 jetty9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3079-1 jetty9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- WID-SEC-2022-0614 Eclipse Jetty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 23, 2025
- WID-SEC-2023-2368 IBM Operational Decision Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 7, 2024
- WID-SEC-2023-0864 Red Hat JBoss A-MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · May 18, 2023
- WID-SEC-2023-0027 IBM Tivoli Network Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Feb 23, 2023