Jetty vulnerabilities

15 known vulnerabilities in Jetty from Eclipse Foundation. 15 are rated high or critical, and 1 has been exploited in real attacks. Each entry lists the affected versions and the release that fixes it, where the vendor has published one.

Latest first

• 9.1 Critical severity

  Eclipse Jetty - EE8: Improper Handling of Alternate Encoding

  CVE-2026-10050Aug 4, 2026Eclipse Foundation

  In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes. This was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical

• 7.5 High severity

  Eclipse Jetty: Exposure of Sensitive Information to an Unauthorized Actor

  CVE-2026-10051Jul 14, 2026Eclipse Foundation

  In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent reque

• 7.5 High severity

  Eclipse Jetty: Uncontrolled Resource Consumption

  CVE-2024-7708Jul 14, 2026Eclipse Foundation

  For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

• 9.1 Critical severity

  Eclipse Jetty: Inconsistent Interpretation of HTTP Requests

  CVE-2026-2332Apr 14, 2026Eclipse FoundationEPSS 1.36%

  In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html

• 7.4 High severity

  Eclipse Jetty: Sensitive Information in Resource Not Removed Before Reuse

  CVE-2026-5795Apr 8, 2026Eclipse Foundation

  In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing th

• 7.5 High severity

  Eclipse Jetty: Missing Release of Memory after Effective Lifetime

  CVE-2026-1605Mar 5, 2026Eclipse Foundation

  In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Infl

• 7.5 High severity

  Eclipse Jetty: Uncontrolled Resource Consumption

  CVE-2025-5115Aug 20, 2025Eclipse JettyEPSS 3.69%

  In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state,

• 7.5 High severity

  Jetty: Uncontrolled Resource Consumption

  CVE-2025-1948May 8, 2025Eclipse Foundation

  In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a

• 7.2 High severity

  Jetty: Improper Resource Shutdown or Release

  CVE-2024-13009May 8, 2025Eclipse Foundation

  In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

• 7.5 High severity

  Jetty: Uncontrolled Resource Consumption

  CVE-2024-9823Oct 14, 2024Eclipse Foundation

  There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory erro

• 7.5 High severity

  jetty.project: Allocation of Resources Without Limits or Throttling

  CVE-2024-22201Feb 26, 2024JettyEPSS 1.43%

  Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors

• 7.5 High severity

  jetty.project: Integer Overflow or Wraparound

  CVE-2023-36478Oct 10, 2023Eclipse FoundationEPSS 4.83%

  Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit

• 7.5 High severity

  HTTP/2 Rapid Reset Attack Exploited

  CVE-2023-44487Oct 10, 2023IETFEPSS 100%

  The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

• 7.5 High severity

  Eclipse Jetty: Improper Resource Shutdown or Release

  CVE-2022-2191Jul 7, 2022Eclipse FoundationEPSS 2.18%

  In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

• 7.5 High severity

  Eclipse Jetty: Insufficient Resource Pool

  CVE-2022-2048Jul 7, 2022Eclipse FoundationEPSS 2.56%

  In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario wh