Every CVE Search/ Get API key

CVE-2019-17632

Unescaped exception messages in error responses in Jetty

6.1 MediumFix available

CVE-2019-17632 is a medium vulnerability (CVSS 6.1) in Eclipse Jetty, published November 25, 2019. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.91%, the 79th percentile. Fixed in org.eclipse.jetty:jetty-server 9.4.24.v20191120.

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

1.91%Up 1.1 points since Apr 14, 2021
90%50%10%1%

What each source reports

NVD Score used 6.1

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Record
CVE-2019-17632
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
CVSS 2.0
4.3 MediumAV:N/AC:M/Au:N/C:N/I:P/A:N
Weakness
CWE-79
Updated
2026-11-02
CVE List No score

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Record
CVE-2019-17632
Weakness
CWE-79
Updated
2026-11-02
EUVDEUVD-2019-0779 No score

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Record
EUVD-2019-0779
Updated
2026-11-03
GitHub AdvisoriesGHSA-5h9j-q6j2-253f 6.1

Unescaped exception messages in error responses in Jetty

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Record
GHSA-5h9j-q6j2-253f
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSV 6.1

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Record
CVE-2019-17632
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2019-17632 6.1

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Record
DEBIAN-CVE-2019-17632
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVGHSA-5h9j-q6j2-253f 6.1

Unescaped exception messages in error responses in Jetty

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Record
GHSA-5h9j-q6j2-253f
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Weakness
CWE-79
Updated
2026-11-02
OSVUBUNTU-CVE-2019-17632 6.1

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Record
UBUNTU-CVE-2019-17632
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.eclipse.jetty:jetty-server
Maven
 9.4.21.v20190926 to 9.4.21.v20190926
9.4.24.v20191120
org.eclipse.jetty:jetty-server
Maven
 9.4.22.v20191022 to 9.4.22.v20191022
9.4.24.v20191120
org.eclipse.jetty:jetty-server
Maven
 9.4.23.v20191118 to 9.4.23.v20191118
9.4.24.v20191120
jetty9
Debian:12
 before 9.4.26-1
9.4.26-1
jetty9
Debian:13
 before 9.4.26-1
9.4.26-1
jetty9
Debian:14
 before 9.4.26-1
9.4.26-1
org.eclipse.jetty:jetty-server
Maven
 9.4.21.v20190926 up to 9.4.24.v20191120, plus listed versions
9.4.22.v201910229.4.23.v20191118
9.4.24.v20191120
org.eclipse.jetty:jetty-server
Maven
 9.4.22.v20191022 up to 9.4.24.v20191120, plus listed versions
9.4.23.v20191118
9.4.24.v20191120
org.eclipse.jetty:jetty-server
Maven
 9.4.23.v20191118 up to 9.4.24.v20191120
9.4.24.v20191120
jetty
Ubuntu:14.04:LTS
 All versions, plus listed versions
6.1.26-1ubuntu16.1.26-1ubuntu1.16.1.26-1ubuntu1.2
 None known
jetty8
Ubuntu:14.04:LTS
 All versions, plus listed versions
8.1.3-88.1.3-9
 None known
jetty
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.1.26-56.1.26-5ubuntu0.1
 None known
jetty8
Ubuntu:16.04:LTS
 All versions, plus listed versions
8.1.17-28.1.18-18.1.18-28.1.18-38.1.19-1
 None known

History

History
WhenChangedSources
2026-11-03aliases, productsEUVD
2026-11-02createdCVE List, GitHub Advisories, NVD, OSV

References

Show 4 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open