Description
There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | Jetty | 9.3.12 – ≤ 9.4.55, 10.0.0 – ≤ 10.0.23, 11.0.0 – ≤ 11.0.23, 12.0.0 – ≤ 12.0.8 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jetty9 | 9.4.56-1 | — |
| Debian 13 | jetty9 | 9.4.56-1 | — |
| Debian 12 | jetty9 | 9.4.57-0+deb12u1 | DSA-5894-1 |
| Debian 11 | jetty9 | 9.4.57-0+deb11u1 | DLA-4106-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 16.04 LTS | jetty | No fix yet | — |
| Ubuntu 14.04 LTS | jetty | No fix yet | — |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP6 | jetty-minimal | 9.4.56-150200.3.28.1 | SUSE-SU-2024:3720-1 |
| SLES 15 SP5 | jetty-minimal | 9.4.56-150200.3.28.1 | SUSE-SU-2024:3720-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jetty-minimal | 9.4.56-2.1 | openSUSE-SU-2024:14408-1 |
| openSUSE Leap 15.6 | jetty-minimal | 9.4.56-150200.3.28.1 | SUSE-SU-2024:3720-1 |
| openSUSE Leap 15.5 | jetty-minimal | 9.4.56-150200.3.28.1 | SUSE-SU-2024:3720-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-nifi +2 | 2.3.0-r0 | — |
| Wolfi rolling | cassandra-reaper | 4.0.1-r1 | — |
| Wolfi rolling | cloudwatch-exporter | 0.16.0-r1 | — |
| Wolfi rolling | confluent-kafka | 8.0.0.29-r0 | — |
| Wolfi rolling | druid +1 | 31.0.0-r1 | — |
| Wolfi rolling | kafka-strimzi-compat +12 | 0.45.0-r1 | — |
| Wolfi rolling | tez | No fix yet | — |
| Wolfi rolling | zookeeper-3.9 +1 | 3.9.3-r0 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | >= 12.0.0, < 12.0.9 | 12.0.9 | GHSA-g8m5-722r-8whq |
| Maven | org.eclipse.jetty:jetty-server | >= 10.0.0, < 10.0.24 | 10.0.24 | GHSA-g8m5-722r-8whq |
| Maven | org.eclipse.jetty:jetty-server | >= 11.0.0, < 11.0.24 | 11.0.24 | GHSA-g8m5-722r-8whq |
| Maven | org.eclipse.jetty:jetty-server | >= 9.3.12, < 9.4.56 | 9.4.56 | GHSA-g8m5-722r-8whq |
Advisories 8
- WID-SEC-2024-3176 Eclipse Jetty: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 25, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- DSA-5894-1 jetty9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4106-1 jetty9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- SUSE-SU-2024:3720-1 Security update for jetty-minimal SUSE / openSUSE Security Updates · Feb 4, 2026
- WID-SEC-2025-1572 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jul 15, 2025
- openSUSE-SU-2024:14408-1 jetty-annotations-9.4.56-2.1 on GA media SUSE / openSUSE Security Updates · May 7, 2025
- NCSC-2025-0123 Kwetsbaarheden verholpen in Oracle Database Producten NCSC-NL (Netherlands) · Apr 16, 2025