JE
Product
Jetty
On CISA KEVExploited in the wild
52
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 21Medium 21Low 4
Watch
Add Jetty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2023-44487 In wildKEV | 7.5 | Oct 10 | HTTP/2 Rapid Reset Attack Vulnerability Affected: before 9.4.53; 10.0.0 before 10.0.17; 11.0.0 before 11.0.17; 12.0.0 before 12.0.2 |
| CVE-2017-7658 | 9.8 | Jun 26 | In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths… Affected: through 9.2.26; 9.3.0 before 9.3.24; 9.4.0 before 9.4.11 |
| CVE-2017-7657 | 9.8 | Jun 26 | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled… Affected: through 9.2.26; 9.3.0 before 9.3.24; 9.4.0 before 9.4.11 |
| CVE-2016-4800 | 9.8 | Apr 13 | The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other… Affected: 9.3.0; 9.3.0; 9.3.0; 9.3.0; 9.3.0; 9.3.0; +13 more |
| CVE-2019-17638 | 9.4 | Jul 9 | In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error Affected: 9.4.27; 9.4.28; 9.4.29 |
| CVE-2026-10050 | 9.1 | Aug 4 | Digest authentication lossy encoding Affected: 9.4.0 before 9.4.63; 10.0.0 before 10.0.31; 11.0.0 before 11.0.31; 12.0.0 before 12.0.36; 12.1.0 before 12.1.10 |
| CVE-2026-2332 | 9.1 | Apr 14 | HTTP Request Smuggling via Chunked Extension Quoted-String Parsing Affected: 9.4.0 before 9.4.60; 10.0.0 before 10.0.28; 11.0.0 before 11.0.28; 12.0.0 before 12.0.33; 12.1.0 before 12.1.7 |
| CVE-2018-12538 | 8.8 | Jun 22 | In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSession details, it is possible for a… Affected: 9.4.0 through 9.4.8 |
| CVE-2024-7708 | 7.5 | Jul 14 | For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak Affected: 10.0.7 before 10.0.23; 11.0.7 before 11.0.23 |
| CVE-2026-10051 | 7.5 | Jul 14 | In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection Affected: 12.0.0 before 12.0.36; 12.1.0 before 12.1.10 |
| CVE-2026-1605 | 7.5 | Mar 5 | In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed… Affected: 12.0.0 before 12.0.32; 12.1.0 before 12.1.6 |
| CVE-2025-5115 | 7.5 | Aug 20 | In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending… Affected: 9.3.0 through 9.4.57; 10.0.0 through 10.0.25; 11.0.0 through 11.0.25; 12.0.0 through 12.0.21; 12.1.0; 12.1.0; +1 more |
| CVE-2025-1948 | 7.5 | May 8 | In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE Affected: 12.0.0 before 12.0.17 |
| CVE-2024-9823 | 7.5 | Oct 14 | There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using… Affected: 9.0.0 before 9.4.54; 10.0.0 before 10.0.18; 11.0.0 before 11.0.18; 12.0.0 before 12.0.3 |
| CVE-2024-22201 | 7.5 | Feb 26 | Jetty is a Java based web server and servlet engine Affected: 9.3.0 before 9.4.54; 10.0.0 before 10.0.20; 11.0.0 before 11.0.20; 12.0.0 before 12.0.6 |
| CVE-2023-36478 | 7.5 | Oct 10 | Eclipse Jetty provides a web server and servlet container Affected: 9.3.0 before 9.4.53; 10.0.0 before 10.0.16; 11.0.0 before 11.0.16 |
| CVE-2022-2191 | 7.5 | Jul 7 | In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code… Affected: 10.0.0 through 10.0.9; 11.0.0 through 11.0.9 |
| CVE-2022-2048 | 7.5 | Jul 7 | In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active… Affected: before 9.4.47; 10.0.0 before 10.0.9; 11.0.0 before 11.0.9 |
| CVE-2021-28165 | 7.5 | Apr 1 | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame Affected: 7.2.2 before 9.4.39; 10.0.0 before 10.0.2; 11.0.0 before 11.0.2 |
| CVE-2009-5045 | 7.5 | Nov 6 | Dump Servlet information leak in jetty before 6.1.22 Affected: before 6.1.22 |
| CVE-2018-12545 | 7.5 | Mar 27 | In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many… Affected: 9.3.0; 9.3.0; 9.3.0; 9.3.0; 9.3.0; 9.3.0; +34 more |
| CVE-2017-7656 | 7.5 | Jun 26 | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly Affected: through 9.2.26; 9.3.0 before 9.3.24; 9.4.0 before 9.4.11 |
| CVE-2017-9735 | 7.5 | Jun 16 | Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for remote attackers to obtain access by observing elapsed times before… Affected: before 9.2.22; 9.3.0 before 9.3.20; 9.4.0 before 9.4.6 |
| CVE-2015-2080 | 7.5 | Oct 7 | The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP… Affected: 9.2.3; 9.2.4; 9.2.5; 9.2.6; 9.2.7; 9.2.8; +2 more |
| CVE-2026-5795 | 7.4 | Apr 8 | In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable Affected: 9.4.0 through 9.4.58; 10.0.0 through 10.0.26; 11.0.0 through 11.0.26; 12.0.0 before 12.0.34; 12.1.0 before 12.1.8 |
| CVE-2024-13009 | 7.2 | May 8 | In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body Affected: 9.4.0 before 9.4.57 |
| CVE-2020-27216 | 7.0 | Oct 23 | In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like systems, the system's temporary directory… Affected: 1.0 before 9.3.29; 9.4.0 through 9.4.32; 10.0.0; 10.0.0; 10.0.0; 10.0.0; +3 more |
| CVE-2025-11143 | 6.5 | Mar 5 | The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components… Affected: 9.4.0 through 9.4.58; 10.0.0 through 10.0.26; 11.0.0 through 11.0.26; 12.0.0 before 12.0.31; 12.1.0 before 12.1.5 |
| CVE-2024-8184 | 6.5 | Oct 14 | There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack Affected: 9.3.12 before 9.4.56; 10.0.0 before 10.0.24; 11.0.0 before 11.0.24; 12.0.0 before 12.0.9 |
| CVE-2024-6762 | 6.5 | Oct 14 | Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory Affected: 10.0.0 before 10.0.18; 11.0.0 before 11.0.18; 12.0.0 before 12.0.4 |
| CVE-2019-17632 | 6.1 | Nov 25 | In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json… Affected: 9.4.21; 9.4.22; 9.4.23 |
| CVE-2009-5046 | 6.1 | Nov 6 | JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22 Affected: before 6.1.22 |
| CVE-2019-10241 | 6.1 | Apr 22 | In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL… Affected: 9.2.0; 9.2.0; 9.2.0; 9.2.0; 9.2.0; 9.2.1; +34 more |
| CVE-2026-8384 | 5.3 | Jul 14 | In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the… Affected: 12.0.0 before 12.0.35; 12.1.0 before 12.1.9 |
| CVE-2026-6790 | 5.3 | Jul 14 | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present) Affected: 9.4.0 before 9.4.61; 10.0.0 before 10.0.29; 11.0.0 before 11.0.29; 12.0.0 before 12.0.35; 12.1.0 before 12.1.9 |
| CVE-2024-6763 | 5.3 | Oct 14 | Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine Affected: 7.0.0 before 9.4.57 |
| CVE-2023-40167 | 5.3 | Sep 15 | Jetty is a Java based web server and servlet engine Affected: 9.0.0 before 9.4.52; 10.0.0 before 10.0.16; 11.0.0 before 11.0.16; 12.0.0; 12.0.0; 12.0.0; +3 more |
| CVE-2023-26049 | 5.3 | Apr 18 | Jetty is a java based web server and servlet engine Affected: before 9.4.51; 10.0.0 before 10.0.14; 11.0.0 before 11.0.14; 12.0.0; 12.0.0; 12.0.0 |
| CVE-2023-26048 | 5.3 | Apr 18 | Jetty is a java based web server and servlet engine Affected: before 9.4.51; 10.0.0 before 10.0.14; 11.0.0 before 11.0.14 |
| CVE-2021-34429 | 5.3 | Jul 15 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or… Affected: 9.4.37 before 9.4.43; 10.0.1 before 10.0.6; 11.0.1 before 11.0.6 |
| CVE-2021-28169 | 5.3 | Jun 9 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the… Affected: before 9.4.41; 10.0.0 before 10.0.3; 11.0.0 before 11.0.3 |
| CVE-2021-28164 | 5.3 | Apr 1 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources… Affected: 9.4.37; 9.4.38 |
| CVE-2020-27223 | 5.3 | Feb 26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of… Affected: 9.4.7 before 9.4.36; 9.4.6; 9.4.6; 9.4.36; 9.4.36; 10.0.0; +1 more |
| CVE-2019-10247 | 5.3 | Apr 22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured… Affected: 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +34 more |
| CVE-2019-10246 | 5.3 | Apr 22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a… Affected: 9.2.27; 9.3.26; 9.4.16 |
| CVE-2018-12536 | 5.3 | Jun 27 | In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and… Affected: 9.0.0 through 9.2.26; 9.3.0 before 9.3.24; 9.4.0 before 9.4.11 |
| CVE-2020-27218 | 4.8 | Nov 28 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests… Affected: 9.4.0 before 9.4.35; 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; +3 more |
| CVE-2023-41900 | 4.3 | Sep 15 | Jetty is a Java based web server and servlet engine Affected: 9.4.21 before 9.4.52; 10.0.0 before 10.0.16; 11.0.0 before 11.0.16 |
| CVE-2021-34428 | 3.5 | Jun 22 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in… Affected: through 9.4.40; 10.0.0 through 10.0.2; 11.0.0 through 11.0.2 |
| CVE-2023-36479 | 3.1 | Sep 15 | Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project Affected: 9.0.0 before 9.4.52; 10.0.0 before 10.0.16; 11.0.0 before 11.0.16; 12.0.0; 12.0.0; 12.0.0; +2 more |