CVE-2011-4461
Improper Input Validation in Jetty
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- None
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- None
- Availability
- Low
Exploit likelihood
What each source reports
NVD Score used
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
CVE-2011-4461- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - CVSS 2.0
- 5.0 Medium
AV:N/AC:L/Au:N/C:N/I:N/A:P - Weakness
- CWE-310
- Updated
- 2026-11-02
CVE List No score
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
CVE-2011-4461- Updated
- 2026-11-02
EUVDEUVD-2022-5062 No score
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
EUVD-2022-5062- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-qxp4-27vx-xmm3
Improper Input Validation in Jetty
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
GHSA-qxp4-27vx-xmm3- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVGHSA-qxp4-27vx-xmm3
Improper Input Validation in Jetty
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
GHSA-qxp4-27vx-xmm3- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2011-4461
Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.
- Record
UBUNTU-CVE-2011-4461- CVSS 3.0
- 5.3 Medium
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L - Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty:jetty-serverMaven |
through 8.1.0.RC2 | 8.1.0.RC4 |
org.eclipse.jetty:jetty-serverMaven |
before 8.1.0.RC4, plus listed versions 7.0.0.M07.0.0.M17.0.0.M27.0.0.M37.0.0.M4 Show 45 moreShow less7.0.0.RC07.0.0.RC17.0.0.RC27.0.0.RC37.0.0.RC47.0.0.RC57.0.0.RC67.0.0.v200910057.0.1.v200911257.0.2.RC07.0.2.v201003317.1.0.RC07.1.0.RC17.1.0.v201005057.1.1.v201005177.1.2.v201005237.1.3.v201005267.1.4.v201006107.1.5.v201007057.1.6.v201007157.2.0.RC07.2.0.v201010207.2.1.v201011117.2.2.v201012057.3.0.v201102037.3.1.v201103077.4.0.RC07.4.0.v201104147.4.1.v201105137.4.2.v201105267.4.3.v201107017.4.4.v201107077.4.5.v201107257.5.0.RC07.5.0.RC17.5.0.RC27.5.0.v201109017.5.1.v201109087.5.2.v201110067.5.3.v201110117.5.4.v201110247.6.0.RC07.6.0.RC17.6.0.RC27.6.0.RC3 |
8.1.0.RC4 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2011-4461 is a medium vulnerability (CVSS 5.3) in Mortbay Jetty, published December 29, 2011. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.92%, the 92nd percentile. Fixed in org.eclipse.jetty:jetty-server 8.1.0.RC4.
References
marc.info?l=bugtraq&m=143387688830075&w=2
security.netapp.com/advisory/ntap-20190307-0004
ubuntu.com/usn/USN-1429-1
oracle.com/technetwork/security-advisory/cpujul2018-4258247.html
nruns.com/_downloads/advisory28122011.pdf
secunia.com/advisories/48981
Show 16 moreShow less
securitytracker.com/id?1026475
kb.cert.org/vuls/id/903934
exchange.xforce.ibmcloud.com/vulnerabilities/72017
archives.neohapsis.com/archives/bugtraq/2011-12/0181.html
ocert.org/advisories/ocert-2011-003.html
nvd.nist.gov/vuln/detail/CVE-2011-4461
github.com/eclipse/jetty.project/commit/085c79d7d6cfbccc02821ffdb64968593df3e0bf
ubuntu.com/security/CVE-2011-4461
dev.eclipse.org/mhonarc/lists/jetty-users/msg01818.html
cve.org/CVERecord?id=CVE-2011-4461
Left out here: 37 versions. The JSON record has them.