Login Request a demo
JE
Product
Jetty
by Eclipse · last CVE Aug 4, 2026
On CISA KEVExploited in the wild
52
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Vulnerabilities52In the news0Timeline
Severity mix
Critical 6High 21Medium 21Low 4
Severity
All severities52Critical6High21Medium21Low4
Exploitation
On CISA KEV1Exploited in the wild1
Watch

Add Jetty to your stack to get only the CVEs that touch what you run.

CVECVSSEPSSPublishedSummary · affected versions
CVE-2017-7658
9.8
19%
Jun 26
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths…
Affected: through 9.2.26; 9.3.0 before 9.3.24; 9.4.0 before 9.4.11
CVE-2017-7657
9.8
15%
Jun 26
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled…
Affected: through 9.2.26; 9.3.0 before 9.3.24; 9.4.0 before 9.4.11
CVE-2016-4800
9.8
6%
Apr 13
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows remote attackers to bypass protected resource restrictions and other…
Affected: 9.3.0; 9.3.0; 9.3.0; 9.3.0; 9.3.0; 9.3.0; +13 more
CVE-2019-17638
9.4
11%
Jul 9
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error
Affected: 9.4.27; 9.4.28; 9.4.29
CVE-2026-10050
9.1
1%
Aug 4
Digest authentication lossy encoding
Affected: 9.4.0 before 9.4.63; 10.0.0 before 10.0.31; 11.0.0 before 11.0.31; 12.0.0 before 12.0.36; 12.1.0 before 12.1.10
CVE-2026-2332
9.1
1%
Apr 14
HTTP Request Smuggling via Chunked Extension Quoted-String Parsing
Affected: 9.4.0 before 9.4.60; 10.0.0 before 10.0.28; 11.0.0 before 11.0.28; 12.0.0 before 12.0.33; 12.1.0 before 12.1.7
Showing 6