org.eclipse.jetty:jetty-server (Maven)
Advisories
70
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 12.1.10 or later clears every advisory below that has a fix.
Upgrade commands
maven
<dependency><groupId>org.eclipse.jetty</groupId><artifactId>jetty-server</artifactId><version>12.1.10</version></dependency>gradle
implementation("org.eclipse.jetty:jetty-server:12.1.10")Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-7p3p-8qv8-m2vh Eclipse Jetty: HTTP Authority/Host mismatch |
Medium EPSS 0.31% |
>= 9.4.0.v20161208, <= 9.4.58.v20250814 | No fix yet |
| GHSA-7p3p-8qv8-m2vh Eclipse Jetty: HTTP Authority/Host mismatch |
Medium EPSS 0.31% |
>= 12.1.0, < 12.1.9 | 12.1.9 |
| GHSA-7p3p-8qv8-m2vh Eclipse Jetty: HTTP Authority/Host mismatch |
Medium EPSS 0.31% |
>= 12.0.0, < 12.0.35 | 12.0.35 |
| GHSA-7p3p-8qv8-m2vh Eclipse Jetty: HTTP Authority/Host mismatch |
Medium EPSS 0.31% |
>= 11.0.0, <= 11.0.26 | No fix yet |
| GHSA-7p3p-8qv8-m2vh Eclipse Jetty: HTTP Authority/Host mismatch |
Medium EPSS 0.31% |
>= 10.0.0, <= 10.0.26 | No fix yet |
| GHSA-f4v5-65jj-pcr2 Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections |
High EPSS 0.43% |
>= 12.0.0, < 12.0.36 | 12.0.36 |
| GHSA-f4v5-65jj-pcr2 Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections |
High EPSS 0.43% |
>= 12.1.0, < 12.1.10 | 12.1.10 |
| GHSA-9299-c6m4-mjhc Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests |
High EPSS 0.44% |
>= 10.0.7, < 10.0.23 | 10.0.23 |
| GHSA-9299-c6m4-mjhc Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests |
High EPSS 0.44% |
>= 11.0.7, < 11.0.23 | 11.0.23 |
| GHSA-xxh7-fcf3-rj7f The Eclipse Jetty Server Artifact has a Gzip request memory leak |
High EPSS 0.74% |
>= 12.0.0, < 12.0.32 | 12.0.32 |
| GHSA-xxh7-fcf3-rj7f The Eclipse Jetty Server Artifact has a Gzip request memory leak |
High EPSS 0.74% |
>= 12.1.0, < 12.1.6 | 12.1.6 |
| GHSA-q4rv-gq96-w7c5 **UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request |
High EPSS 0.55% |
>= 9.4.0, < 9.4.57.v20241219 | 9.4.57.v20241219 |
| GHSA-g8m5-722r-8whq Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks |
Medium EPSS 1.03% |
>= 9.3.12, < 9.4.56 | 9.4.56 |
| GHSA-g8m5-722r-8whq Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks |
Medium EPSS 1.03% |
>= 10.0.0, < 10.0.24 | 10.0.24 |
| GHSA-g8m5-722r-8whq Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks |
Medium EPSS 1.03% |
>= 12.0.0, < 12.0.9 | 12.0.9 |
| GHSA-g8m5-722r-8whq Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks |
Medium EPSS 1.03% |
>= 11.0.0, < 11.0.24 | 11.0.24 |
| GHSA-p26g-97m4-6q7c Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies |
Medium EPSS 1.30% |
< 9.4.51.v20230217 | 9.4.51.v20230217 |
| GHSA-p26g-97m4-6q7c Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies |
Medium EPSS 1.30% |
>= 11.0.0, < 11.0.14 | 11.0.14 |
| GHSA-p26g-97m4-6q7c Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies |
Medium EPSS 1.30% |
>= 12.0.0alpha0, < 12.0.0.beta0 | 12.0.0.beta0 |
| GHSA-p26g-97m4-6q7c Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies |
Medium EPSS 1.30% |
>= 10.0.0, < 10.0.14 | 10.0.14 |
| GHSA-qw69-rqj8-6qw8 OutOfMemoryError for large multipart without filename in Eclipse Jetty |
Medium EPSS 3.37% |
>= 11.0.0, < 11.0.14 | 11.0.14 |
| GHSA-qw69-rqj8-6qw8 OutOfMemoryError for large multipart without filename in Eclipse Jetty |
Medium EPSS 3.37% |
< 9.4.51.v20230217 | 9.4.51.v20230217 |
| GHSA-qw69-rqj8-6qw8 OutOfMemoryError for large multipart without filename in Eclipse Jetty |
Medium EPSS 3.37% |
>= 10.0.0, < 10.0.14 | 10.0.14 |
| GHSA-8mpp-f3f7-xc28 Jetty SslConnection does not release pooled ByteBuffers in case of errors |
High EPSS 2.18% |
>= 10.0.0, < 10.0.10 | 10.0.10 |
| GHSA-8mpp-f3f7-xc28 Jetty SslConnection does not release pooled ByteBuffers in case of errors |
High EPSS 2.18% |
>= 11.0.0, < 11.0.10 | 11.0.10 |
| GHSA-qxp4-27vx-xmm3 Improper Input Validation in Jetty |
Medium EPSS 4.92% |
< 8.1.0.RC4 | 8.1.0.RC4 |
| GHSA-jg2x-r643-w2ch Jetty Uses Predictable Session Identifiers |
Medium EPSS 1.61% |
< 4.2.27 | 4.2.27 |
| GHSA-jg2x-r643-w2ch Jetty Uses Predictable Session Identifiers |
Medium EPSS 1.61% |
>= 5.1.0, < 5.1.12 | 5.1.12 |
| GHSA-jg2x-r643-w2ch Jetty Uses Predictable Session Identifiers |
Medium EPSS 1.61% |
>= 6.0.0, < 6.0.2 | 6.0.2 |
| GHSA-jg2x-r643-w2ch Jetty Uses Predictable Session Identifiers |
Medium EPSS 1.61% |
>= 6.1.0pre1, < 6.1.0pre3 | 6.1.0pre3 |
| GHSA-m6cp-vxjx-65j6 SessionListener can prevent a session from being invalidated breaking logout |
Low EPSS 0.96% |
>= 10.0.0, < 10.0.3 | 10.0.3 |
| GHSA-m6cp-vxjx-65j6 SessionListener can prevent a session from being invalidated breaking logout |
Low EPSS 0.96% |
< 9.4.41 | 9.4.41 |
| GHSA-m6cp-vxjx-65j6 SessionListener can prevent a session from being invalidated breaking logout |
Low EPSS 0.96% |
>= 11.0.0, < 11.0.3 | 11.0.3 |
| GHSA-26vr-8j45-3r4w Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources |
High EPSS 53.86% |
>= 11.0.0, < 11.0.2 | 11.0.2 |
| GHSA-26vr-8j45-3r4w Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources |
High EPSS 53.86% |
>= 10.0.0, < 10.0.2 | 10.0.2 |
| GHSA-26vr-8j45-3r4w Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources |
High EPSS 53.86% |
>= 7.2.2, < 9.4.39 | 9.4.39 |
| GHSA-m394-8rww-3jr7 DOS vulnerability for Quoted Quality CSV headers |
Medium EPSS 78.03% |
>= 11.0.0, < 11.0.1 | 11.0.1 |
| GHSA-m394-8rww-3jr7 DOS vulnerability for Quoted Quality CSV headers |
Medium EPSS 78.03% |
>= 9.4.6, < 9.4.37 | 9.4.37 |
| GHSA-m394-8rww-3jr7 DOS vulnerability for Quoted Quality CSV headers |
Medium EPSS 78.03% |
>= 10.0.0, < 10.0.1 | 10.0.1 |
| GHSA-86wm-rrjm-8wh8 Buffer not correctly recycled in Gzip Request inflation |
Medium EPSS 8.28% |
>= 9.4.0, < 9.4.35.v20201120 | 9.4.35.v20201120 |
| GHSA-x3rh-m7vp-35f2 Operation on a Resource after Expiration or Release in Jetty Server |
Critical EPSS 11.14% |
>= 9.4.27, < 9.4.30.v20200611 | 9.4.30.v20200611 |
| GHSA-5h9j-q6j2-253f Unescaped exception messages in error responses in Jetty |
Medium EPSS 1.91% |
>= 9.4.23.v20191118, < 9.4.24.v20191120 | 9.4.24.v20191120 |
| GHSA-5h9j-q6j2-253f Unescaped exception messages in error responses in Jetty |
Medium EPSS 1.91% |
>= 9.4.22.v20191022, < 9.4.24.v20191120 | 9.4.24.v20191120 |
| GHSA-5h9j-q6j2-253f Unescaped exception messages in error responses in Jetty |
Medium EPSS 1.91% |
>= 9.4.21.v20190926, < 9.4.24.v20191120 | 9.4.24.v20191120 |
| GHSA-r28m-g6j9-r2h5 Information Exposure vulnerability in Eclipse Jetty |
Medium EPSS 4.09% |
>= 9.4.0, < 9.4.17.v20190418 | 9.4.17.v20190418 |
| GHSA-r28m-g6j9-r2h5 Information Exposure vulnerability in Eclipse Jetty |
Medium EPSS 4.09% |
>= 9.2.0, < 9.2.28.v20190418 | 9.2.28.v20190418 |
| GHSA-r28m-g6j9-r2h5 Information Exposure vulnerability in Eclipse Jetty |
Medium EPSS 4.09% |
>= 9.3.0, < 9.3.27.v20190418 | 9.3.27.v20190418 |
| GHSA-xc67-hjx6-cgg6 Installation information leak in Eclipse Jetty |
Medium EPSS 5.94% |
>= 9.3.0, < 9.3.27.v20190418 | 9.3.27.v20190418 |
| GHSA-xc67-hjx6-cgg6 Installation information leak in Eclipse Jetty |
Medium EPSS 5.94% |
>= 9.4.0, < 9.4.17.v20190418 | 9.4.17.v20190418 |
| GHSA-xc67-hjx6-cgg6 Installation information leak in Eclipse Jetty |
Medium EPSS 5.94% |
>= 7.0.0, < 9.2.28.v20190418 | 9.2.28.v20190418 |
| GHSA-7vx9-xjhr-rw6h Cross-site Scripting in Eclipse Jetty |
Medium EPSS 9.37% |
>= 9.4.0, < 9.4.16.v20190411 | 9.4.16.v20190411 |
| GHSA-7vx9-xjhr-rw6h Cross-site Scripting in Eclipse Jetty |
Medium EPSS 9.37% |
< 9.2.27.v20190403 | 9.2.27.v20190403 |
| GHSA-7vx9-xjhr-rw6h Cross-site Scripting in Eclipse Jetty |
Medium EPSS 9.37% |
>= 9.3.0, < 9.3.26.v20190403 | 9.3.26.v20190403 |
| GHSA-h2f4-v4c4-6wx4 Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server |
High EPSS 5.12% |
>= 9.4.0, < 9.4.12.v20180830 | 9.4.12.v20180830 |
| GHSA-h2f4-v4c4-6wx4 Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server |
High EPSS 5.12% |
>= 9.3.0, < 9.3.25.v20180904 | 9.3.25.v20180904 |
| GHSA-ghgj-3xqr-6jfm Jetty vulnerable to exposure of sensitive information to unauthenticated remote users |
High EPSS 75.44% |
< 9.2.9.v20150224 | 9.2.9.v20150224 |
| GHSA-6x9x-8qw9-9pp6 Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling) |
Critical EPSS 19.36% |
>= 9.3.0, < 9.3.24.v20180605 | 9.3.24.v20180605 |
| GHSA-6x9x-8qw9-9pp6 Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling) |
Critical EPSS 19.36% |
>= 9.4.0, < 9.4.11.v20180605 | 9.4.11.v20180605 |
| GHSA-6x9x-8qw9-9pp6 Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling) |
Critical EPSS 19.36% |
< 9.2.25.v20180606 | 9.2.25.v20180606 |
| GHSA-84q7-p226-4x5w Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling) |
High EPSS 6.33% |
>= 9.4.0, < 9.4.11.v20180605 | 9.4.11.v20180605 |
| GHSA-84q7-p226-4x5w Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling) |
High EPSS 6.33% |
< 9.3.24.v20180605 | 9.3.24.v20180605 |
| GHSA-872g-2h8h-362q Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request |
Critical EPSS 6.36% |
>= 9.3.0, < 9.3.9 | 9.3.9 |
| GHSA-9rgv-h7x4-qw8g Eclipse Jetty Server generates error message containing sensitive information |
Medium EPSS 4.39% |
>= 9.4.0, < 9.4.11.v20180605 | 9.4.11.v20180605 |
| GHSA-9rgv-h7x4-qw8g Eclipse Jetty Server generates error message containing sensitive information |
Medium EPSS 4.39% |
>= 9.0.0, < 9.3.24.v20180605 | 9.3.24.v20180605 |
| GHSA-wfcc-pff6-rgc5 Jetty vulnerable to exposure of sensitive information due to observable discrepancy |
High EPSS 5.79% |
< 9.2.22.v20170606 | 9.2.22.v20170606 |
| GHSA-wfcc-pff6-rgc5 Jetty vulnerable to exposure of sensitive information due to observable discrepancy |
High EPSS 5.79% |
>= 9.3.0, < 9.3.20.v20170531 | 9.3.20.v20170531 |
| GHSA-wfcc-pff6-rgc5 Jetty vulnerable to exposure of sensitive information due to observable discrepancy |
High EPSS 5.79% |
>= 9.4.0, < 9.4.6.v20170531 | 9.4.6.v20170531 |
| GHSA-vgg8-72f2-qm23 Critical severity vulnerability that affects org.eclipse.jetty:jetty-server |
Critical EPSS 14.88% |
>= 9.3.0, < 9.3.24.v20180605 | 9.3.24.v20180605 |
| GHSA-vgg8-72f2-qm23 Critical severity vulnerability that affects org.eclipse.jetty:jetty-server |
Critical EPSS 14.88% |
< 9.2.25.v20180606 | 9.2.25.v20180606 |
| GHSA-mwcx-532g-8pq3 Access and integrity issue within Eclipse Jetty |
High EPSS 2.56% |
>= 9.4.0, < 9.4.11.v20180605 | 9.4.11.v20180605 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor