Jetty (Eclipse) - vulnerabilities (CVEs)

52 CVEs, 0 in the last 30 days, 736 known versions, newest CVE from 2026-08-04. Vendor: Eclipse.

CVEs of Jetty

CVE-2026-10050 - CVSS 9.1 (critical), 2026-08-04: In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial…
CVE-2024-7708 - CVSS 7.5 (high), 2026-07-14: For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but…
CVE-2026-8384 - CVSS 5.3 (medium), 2026-07-14: In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the…
CVE-2026-6790 - CVSS 5.3 (medium), 2026-07-14: In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the…
CVE-2026-10051 - CVSS 7.5 (high), 2026-07-14: In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.…
CVE-2026-2332 - CVSS 9.1 (critical), 2026-04-14: In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined…
CVE-2026-5795 - CVSS 7.4 (high), 2026-04-08: In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial…
CVE-2026-1605 - CVSS 7.5 (high), 2026-03-05: In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding:…
CVE-2025-11143 - CVSS 6.5 (medium), 2026-03-05: The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using…
CVE-2025-5115 - CVSS 7.7 (high), 2025-08-20: In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for…
CVE-2025-1948 - CVSS 7.5 (high), 2025-05-08: In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter…
CVE-2024-13009 - CVSS 7.2 (high), 2025-05-08: In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can…
CVE-2024-8184 - CVSS 6.5 (medium), 2024-10-14: There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service…
CVE-2024-6763 - CVSS 5.3 (medium), 2024-10-14: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The…
CVE-2024-6762 - CVSS 6.5 (medium), 2024-10-14: Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.
CVE-2024-9823 - CVSS 7.5 (high), 2024-10-14: There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the…
CVE-2024-22201 - CVSS 7.5 (high), 2024-02-26: Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An…
CVE-2023-36478 - CVSS 7.5 (high), 2023-10-10: Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer…
CVE-2023-44487 - CVSS 7.5 (high), 2023-10-10: The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the…
CVE-2023-41900 - CVSS 4.3 (medium), 2023-09-15: Jetty is a Java based web server and servlet engine. Versions 9.4.21 through 9.4.51, 10.0.15, and 11.0.15 are vulnerable to weak authentication. If a Jetty…
CVE-2023-40167 - CVSS 5.3 (medium), 2023-09-15: Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the…
CVE-2023-36479 - CVSS 3.5 (low), 2023-09-15: Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have…
CVE-2023-26049 - CVSS 5.3 (medium), 2023-04-18: Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or…
CVE-2023-26048 - CVSS 5.3 (medium), 2023-04-18: Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call…
CVE-2022-2191 - CVSS 7.5 (high), 2022-07-07: In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in…
CVE-2022-2048 - CVSS 7.5 (high), 2022-07-07: In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly…
CVE-2022-2047 - CVSS 2.7 (low), 2022-07-07: In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme…
CVE-2021-34429 - CVSS 5.3 (medium), 2021-07-15: For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the…
CVE-2021-34428 - CVSS 3.5 (low), 2021-06-22: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID…
CVE-2021-28169 - CVSS 5.3 (medium), 2021-06-09: For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected…
CVE-2021-28164 - CVSS 5.3 (medium), 2021-04-01: In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access…
CVE-2021-28163 - CVSS 2.7 (low), 2021-04-01: In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, the contents of…
CVE-2021-28165 - CVSS 7.5 (high), 2021-04-01: In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVE-2020-27223 - CVSS 5.3 (medium), 2021-02-26: In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a…
CVE-2020-27218 - CVSS 4.8 (medium), 2020-11-28: In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is…
CVE-2020-27216 - CVSS 7 (high), 2020-10-23: In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's…
CVE-2019-17638 - CVSS 9.4 (critical), 2020-07-09: In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431…
CVE-2019-17632 - CVSS 6.1 (medium), 2019-11-25: In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html…
CVE-2009-5046 - CVSS 6.1 (medium), 2019-11-06: JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22.
CVE-2009-5045 - CVSS 7.5 (high), 2019-11-06: Dump Servlet information leak in jetty before 6.1.22.
CVE-2019-10247 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will…
CVE-2019-10246 - CVSS 5.3 (medium), 2019-04-22: In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory…
CVE-2019-10241 - CVSS 6.1 (medium), 2019-04-22: In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a…
CVE-2018-12545 - CVSS 7.5 (high), 2019-03-27: In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames…
CVE-2018-12536 - CVSS 5.3 (medium), 2018-06-27: In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a…
CVE-2017-7658 - CVSS 9.8 (critical), 2018-06-26: In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two…
CVE-2017-7657 - CVSS 9.8 (critical), 2018-06-26: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled),…
CVE-2017-7656 - CVSS 7.5 (high), 2018-06-26: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is…
CVE-2018-12538 - CVSS 8.8 (high), 2018-06-22: In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it…
CVE-2017-9735 - CVSS 7.5 (high), 2017-06-16: Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing…
CVE-2016-4800 - CVSS 9.8 (critical), 2017-04-13: The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource…
CVE-2015-2080 - CVSS 7.5 (high), 2016-10-07: The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal…