Description
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| eclipse | jetty.project | >= 9.0.0, <= 9.4.51, >= 10.0.0, <= 10.0.15, >= 11.0.0, <= 11.0.15, = 12.0.0 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jetty9 | 9.4.52-1 | — |
| Debian 13 | jetty9 | 9.4.52-1 | — |
| Debian 12 | jetty9 | 9.4.50-4+deb12u1 | DSA-5507-1 |
| Debian 11 | jetty9 | 9.4.39-3+deb11u2 | DSA-5507-1 |
| Debian 10 | jetty9 | 9.4.16-0+deb10u3 | DLA-3592-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 22.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 20.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 18.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 16.04 LTS | jetty9 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Utils 6 | foreman +1 | 3.9.1.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | foreman +1 | 3.9.1.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | mosquitto | 2.0.17-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite Capsule 6 | puppet-agent | 7.27.0-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite Capsule 6 | puppetserver | 7.14.0-1.el8sat | RHSA-2024:2010, RHSA-2024:0797 |
| Red Hat Satellite Capsule 6 | python-aiohttp +1 | 3.9.2-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-django +1 | 4.2.9-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-galaxy-importer +1 | 0.4.19-2.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-jinja2 +1 | 3.1.3-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-pycryptodomex +1 | 3.20.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | python-pygments +1 | 2.17.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite Capsule 6 | rubygem-activesupport | 6.1.7.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | candlepin +1 | 4.3.11-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | foreman +14 | 3.9.1.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | mosquitto | 2.0.17-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | puppet-agent | 7.27.0-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | puppetserver | 7.14.0-1.el8sat | RHSA-2024:2010, RHSA-2024:0797 |
| Red Hat Satellite 6 | python-aiohttp +1 | 3.9.2-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-django +1 | 4.2.9-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-galaxy-importer +1 | 0.4.19-2.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-jinja2 +1 | 3.1.3-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-pycryptodomex +1 | 3.20.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | python-pygments +1 | 2.17.0-1.el8pc | RHSA-2024:2010 |
| Red Hat Satellite 6 | rubygem-activesupport | 6.1.7.6-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | rubygem-audited | 5.4.2-1.el8sat | RHSA-2024:2010 |
| Red Hat Satellite 6 | rubygem-grpc | 1.58.0-1.el8sat | RHSA-2024:0797 |
| Red Hat Satellite 6 | rubygem-puma | 6.3.1-1.el8sat | RHSA-2024:2010, RHSA-2024:0797 |
| Red Hat Satellite 6 | rubygem-sidekiq | 6.5.12-1.el8sat | RHSA-2024:0797 |
Show 1 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.426.3.1706515686-3.el8 | RHSA-2024:0778 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1706515741-1.el8 | RHSA-2024:0778 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP5 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
| SLES 15 SP4 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
| SLES 15 SP3 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
| SLES 15 SP2 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
Show 5 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP3 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
| SLES for SAP 15 SP2 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
| SLE HPC 15 SP3 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
| SLE HPC 15 SP2 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
| SUSE Enterprise Storage 7.1 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Leap 15.5 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
| openSUSE Leap 15.4 | jetty-minimal | 9.4.53-150200.3.22.1 | SUSE-SU-2023:4210-1 |
Amazon Linux
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Amazon Linux 2 | jetty-io +35 | 9.0.3-8.amzn2.0.3 | ALAS2-2024-2460 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | cassandra-reaper | 4.0.1-r1 | — |
| Wolfi rolling | cloudwatch-exporter | 0.15.4-r3 | — |
| Wolfi rolling | druid | 35.0.1-r1 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
GitHub 1 repository
-
uthrasri/Jetty-v9.4.31_CVE-2023-40167 ★ 0 · Mar 3, 2025
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-http | >= 9.0.0, < 9.4.52 | 9.4.52 | GHSA-hmr7-m48g-48f6 |
| Maven | org.eclipse.jetty:jetty-http | >= 10.0.0, < 10.0.16 | 10.0.16 | GHSA-hmr7-m48g-48f6 |
| Maven | org.eclipse.jetty:jetty-http | >= 11.0.0, < 11.0.16 | 11.0.16 | GHSA-hmr7-m48g-48f6 |
| Maven | org.eclipse.jetty:jetty-http | >= 12.0.0, < 12.0.1 | 12.0.1 | GHSA-hmr7-m48g-48f6 |
Advisories 16
- RHSA-2024:0797 Red Hat Security Advisory: Satellite 6.14.2 Async Security Update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- RHSA-2024:2010 Red Hat Security Advisory: Satellite 6.15.0 release Red Hat Security Advisories (RHSA) · Oct 13, 2026
- RHSA-2024:0778 Red Hat Security Advisory: Jenkins and Jenkins-2-plugins security update Red Hat Security Advisories (RHSA) · Oct 13, 2026
- WID-SEC-2024-0794 Dell ECS: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 11, 2026
- WID-SEC-2023-2359 Eclipse Jetty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 5, 2026
- DSA-5507-1 jetty9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-3592-1 jetty9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2023:4210-1 Security update for jetty-minimal SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2024-0949 Red Hat Satellite: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 26, 2026
- WID-SEC-2023-3070 Red Hat JBoss A-MQ: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 16, 2025
- WID-SEC-2025-0810 Oracle Retail Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 15, 2025
- NCSC-2024-0296 Kwetsbaarheden verholpen in Oracle Enterprise Manager NCSC-NL (Netherlands) · Jul 17, 2024
- WID-SEC-2024-1639 Oracle Enterprise Manager: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 16, 2024
- ALAS2-2024-2460 Moderate: jetty security update (Amazon Linux 2) Amazon Linux Security Center (ALAS) · Feb 19, 2024
- WID-SEC-2024-0106 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 16, 2024
- WID-SEC-2023-2679 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 17, 2023