Product:

Jetty

(Eclipse)
Repositories

Unknown:

This might be proprietary software.
#Vulnerabilities 36
Date Id Summary Products Score Patch Annotated
2023-09-15 CVE-2023-40167 Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection... Debian_linux, Jetty 5.3
2023-04-18 CVE-2023-26048 Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An... Jetty 5.3
2022-07-07 CVE-2022-2048 In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests. Debian_linux, Jetty, Jenkins, Element_plug\-In_for_vcenter_server, Hci_compute_node, Management_services_for_element_software_and_netapp_hci, Snapcenter, Solidfire_\&_hci_storage_node 7.5
2022-07-07 CVE-2022-2047 In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario. Debian_linux, Jetty, Element_plug\-In_for_vcenter_server, Hci_compute_node, Management_services_for_element_software_and_netapp_hci, Snapcenter, Solidfire_\&_hci_storage_node 2.7
2022-07-07 CVE-2022-2191 In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths. Jetty 7.5
2017-04-13 CVE-2016-4800 The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other security constraints via a URL with certain escaped characters, related to backslashes. Jetty 9.8
2019-11-06 CVE-2009-5046 JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22. Debian_linux, Jetty N/A
2019-11-06 CVE-2009-5045 Dump Servlet information leak in jetty before 6.1.22. Debian_linux, Jetty N/A
2019-03-27 CVE-2018-12545 In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings. Jetty 7.5
2016-10-07 CVE-2015-2080 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak. Jetty, Fedora 7.5