JE
Product
Jetty
On CISA KEVExploited in the wild
52
CVEs
1
On KEV
9.8
Max CVSS
0
New 30D
Severity mix
Critical 6High 21Medium 21Low 4
Watch
Add Jetty to your stack to get only the CVEs that touch what you run.
| CVE | CVSS | Published | Summary · affected versions |
|---|---|---|---|
| CVE-2025-11143 | 6.5 | Mar 5 | The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components… Affected: 9.4.0 through 9.4.58; 10.0.0 through 10.0.26; 11.0.0 through 11.0.26; 12.0.0 before 12.0.31; 12.1.0 before 12.1.5 |
| CVE-2024-8184 | 6.5 | Oct 14 | There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack Affected: 9.3.12 before 9.4.56; 10.0.0 before 10.0.24; 11.0.0 before 11.0.24; 12.0.0 before 12.0.9 |
| CVE-2024-6762 | 6.5 | Oct 14 | Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory Affected: 10.0.0 before 10.0.18; 11.0.0 before 11.0.18; 12.0.0 before 12.0.4 |
| CVE-2019-17632 | 6.1 | Nov 25 | In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json… Affected: 9.4.21; 9.4.22; 9.4.23 |
| CVE-2009-5046 | 6.1 | Nov 6 | JSP Dump and Session Dump Servlet XSS in jetty before 6.1.22 Affected: before 6.1.22 |
| CVE-2019-10241 | 6.1 | Apr 22 | In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL… Affected: 9.2.0; 9.2.0; 9.2.0; 9.2.0; 9.2.0; 9.2.1; +34 more |
| CVE-2026-8384 | 5.3 | Jul 14 | In Eclipse Jetty, an HTTP URI of this form: /public;/../admin/secret.txt results in an unresolved path of: /public/../admin/secret.txt instead of the… Affected: 12.0.0 before 12.0.35; 12.1.0 before 12.1.9 |
| CVE-2026-6790 | 5.3 | Jul 14 | In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present) Affected: 9.4.0 before 9.4.61; 10.0.0 before 10.0.29; 11.0.0 before 11.0.29; 12.0.0 before 12.0.35; 12.1.0 before 12.1.9 |
| CVE-2024-6763 | 5.3 | Oct 14 | Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine Affected: 7.0.0 before 9.4.57 |
| CVE-2023-40167 | 5.3 | Sep 15 | Jetty is a Java based web server and servlet engine Affected: 9.0.0 before 9.4.52; 10.0.0 before 10.0.16; 11.0.0 before 11.0.16; 12.0.0; 12.0.0; 12.0.0; +3 more |
| CVE-2023-26049 | 5.3 | Apr 18 | Jetty is a java based web server and servlet engine Affected: before 9.4.51; 10.0.0 before 10.0.14; 11.0.0 before 11.0.14; 12.0.0; 12.0.0; 12.0.0 |
| CVE-2023-26048 | 5.3 | Apr 18 | Jetty is a java based web server and servlet engine Affected: before 9.4.51; 10.0.0 before 10.0.14; 11.0.0 before 11.0.14 |
| CVE-2021-34429 | 5.3 | Jul 15 | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or… Affected: 9.4.37 before 9.4.43; 10.0.1 before 10.0.6; 11.0.1 before 11.0.6 |
| CVE-2021-28169 | 5.3 | Jun 9 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the… Affected: before 9.4.41; 10.0.0 before 10.0.3; 11.0.0 before 11.0.3 |
| CVE-2021-28164 | 5.3 | Apr 1 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segments to access protected resources… Affected: 9.4.37; 9.4.38 |
| CVE-2020-27223 | 5.3 | Feb 26 | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of… Affected: 9.4.7 before 9.4.36; 9.4.6; 9.4.6; 9.4.36; 9.4.36; 10.0.0; +1 more |
| CVE-2019-10247 | 5.3 | Apr 22 | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version combination will reveal the configured… Affected: 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; 7.0.0; +34 more |
| CVE-2019-10246 | 5.3 | Apr 22 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Resource directory name on Windows to a… Affected: 9.2.27; 9.3.26; 9.4.16 |
| CVE-2018-12536 | 5.3 | Jun 27 | In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and… Affected: 9.0.0 through 9.2.26; 9.3.0 before 9.3.24; 9.4.0 before 9.4.11 |
| CVE-2020-27218 | 4.8 | Nov 28 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests… Affected: 9.4.0 before 9.4.35; 10.0.0; 10.0.0; 10.0.0; 10.0.0; 10.0.0; +3 more |
| CVE-2023-41900 | 4.3 | Sep 15 | Jetty is a Java based web server and servlet engine Affected: 9.4.21 before 9.4.52; 10.0.0 before 10.0.16; 11.0.0 before 11.0.16 |
Showing 21