Every CVE Search/ Get API key

CVE-2021-34428

SessionListener can prevent a session from being invalidated breaking logout

2.9 LowPublic exploitFix available

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Attack profile

How easy it is to exploit

Attack vector
Physical
Complexity
High
Privileges needed
None
User interaction
Required

What an attacker can affect

Confidentiality
Low
Integrity
Low
Availability
None

Exploit likelihood

0.96%Up 0.3 points since Jun 23, 2021
90%50%10%1%

What each source reports

CVE List Score used 2.9

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Record
CVE-2021-34428
CVSS 3.1
2.9 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Weakness
CWE-613
Updated
2026-11-02
EUVDEUVD-2021-1354 2.9

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Record
EUVD-2021-1354
CVSS 3.1
2.9 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
Updated
2026-11-03
GitHub AdvisoriesGHSA-m6cp-vxjx-65j6 3.5

SessionListener can prevent a session from being invalidated breaking logout

Impact

If an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

There is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception. The OP has also identified that during the call to sessionDestroyed, the getLastAccessedTime() throws an IllegalStateException, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out. If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out.

Workarounds

The application should catch all Throwables within their SessionListener#sessionDestroyed() implementations.

Record
GHSA-m6cp-vxjx-65j6
CVSS 3.1
3.5 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-613
Updated
2026-11-02
NVD 2.9

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Record
CVE-2021-34428
CVSS 3.1
2.9 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1
3.5 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
CVSS 2.0
3.6 LowAV:L/AC:L/Au:N/C:P/I:P/A:N
Weakness
CWE-613
Updated
2026-11-02
OSV 3.5

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Record
CVE-2021-34428
CVSS 3.1
3.5 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVDEBIAN-CVE-2021-34428 3.5

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Record
DEBIAN-CVE-2021-34428
CVSS 3.1
3.5 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
Show 6 moreShow less
OSVGHSA-m6cp-vxjx-65j6 3.5

SessionListener can prevent a session from being invalidated breaking logout

Impact

If an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

There is no known path for an attacker to induce such an exception to be thrown, thus they must rely on an application to throw such an exception. The OP has also identified that during the call to sessionDestroyed, the getLastAccessedTime() throws an IllegalStateException, which potentially contrary to the servlet spec, so applications calling this method may always throw and fail to log out. If such an application was only tested on a non clustered test environment, then it may be deployed on a clustered environment with multiple contexts and fail to log out.

Workarounds

The application should catch all Throwables within their SessionListener#sessionDestroyed() implementations.

Record
GHSA-m6cp-vxjx-65j6
CVSS 3.1
3.5 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Weakness
CWE-613
Updated
2026-11-02
OSVOESA-2021-1263 6.1

jetty security update

Jetty is a 100% Java HTTP Server and Servlet Container. This means that you\ do not need to configure and run a separate web server (like Apache) in order\ to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully\ featured web server for static and dynamic content. Unlike separate\ server/container solutions, this means that your web server and web\ application run in the same process, without interconnection overheads\ and complications. Furthermore, as a pure java component, Jetty can be simply\ included in your application for demonstration, distribution or deployment.\ Jetty is available on all Java supported platforms. \ %global extdesc \ \ This package contains

Security Fix(es):

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.(CVE-2021-34428)

Record
OESA-2021-1263
CVSS 3.1
6.1 MediumCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Updated
2026-11-02
OSVRHSA-2021:3758 7.5

Red Hat Security Advisory: OpenShift Container Platform 4.9.0 packages and security update

Record
RHSA-2021:3758
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2021-34428 2.9

For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.

Record
UBUNTU-CVE-2021-34428
CVSS 3.1
2.9 LowCVSS:3.1/AV:P/AC:H/PR:N/UI:R/S:U/C:L/I:L/A:N
CVSS 3.1
3.5 LowCVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Updated
2026-11-02
OSVCLSA-2026-1768522122 No score

TuxCare security update for org.eclipse.jetty (4 CVEs)

TuxCare rebuilt 2 org.eclipse.jetty packages to address 4 CVEs. Fixed in 8.2.0.v20160908-tuxcare.1.

Record
CLSA-2026-1768522122
Updated
2026-11-02
OSVCLSA-2026-1790767173 No score

TuxCare security update for 3 packages (2 CVEs)

TuxCare rebuilt 3 packages to address 2 CVEs. Fixed in 9.4.24.v20191120-tuxcare.5.

Record
CLSA-2026-1790767173
Updated
2026-11-02

Affected products

Show 6 moreShow less

Affected packages

Affected packages
PackageAffectedFixed
org.eclipse.jetty:jetty-server
Maven
 through 9.4.40
9.4.41
org.eclipse.jetty:jetty-server
Maven
 10.0.0 to 10.0.2
10.0.3
org.eclipse.jetty:jetty-server
Maven
 11.0.0 to 11.0.2
11.0.3
org.eclipse.jetty:jetty-server
TuxCare:Maven
From an advisory covering 4 CVEs
 8.2.0.v20160908 up to 8.2.0.v20160908-tuxcare.1
8.2.0.v20160908-tuxcare.1
org.eclipse.jetty:jetty-webapp
TuxCare:Maven
From an advisory covering 4 CVEs
 8.2.0.v20160908 up to 8.2.0.v20160908-tuxcare.1
8.2.0.v20160908-tuxcare.1
org.eclipse.jetty.http2:http2-common
TuxCare:Maven
From an advisory covering 2 CVEs
 9.4.24.v20191120 up to 9.4.24.v20191120-tuxcare.5, plus listed versions
9.4.24.v20191120-tuxcare.19.4.24.v20191120-tuxcare.29.4.24.v20191120-tuxcare.39.4.24.v20191120-tuxcare.4
9.4.24.v20191120-tuxcare.5
org.eclipse.jetty.http2:http2-server
TuxCare:Maven
From an advisory covering 2 CVEs
 9.4.24.v20191120 up to 9.4.24.v20191120-tuxcare.5, plus listed versions
9.4.24.v20191120-tuxcare.19.4.24.v20191120-tuxcare.29.4.24.v20191120-tuxcare.39.4.24.v20191120-tuxcare.4
9.4.24.v20191120-tuxcare.5
org.eclipse.jetty:jetty-server
TuxCare:Maven
From an advisory covering 2 CVEs
 9.4.24.v20191120 up to 9.4.24.v20191120-tuxcare.5, plus listed versions
9.4.24.v20191120-tuxcare.19.4.24.v20191120-tuxcare.29.4.24.v20191120-tuxcare.39.4.24.v20191120-tuxcare.4
9.4.24.v20191120-tuxcare.5
jetty9
Debian:12
 before 9.4.39-2
9.4.39-2
jetty9
Debian:13
 before 9.4.39-2
9.4.39-2
Show 32 moreShow less
Affected packages
PackageAffectedFixed
jetty9
Debian:14
 before 9.4.39-2
9.4.39-2
jetty9
Debian:10
From an advisory covering 7 CVEs
 before 9.4.16-0+deb10u1, plus listed versions
9.4.15-1
9.4.16-0+deb10u1
org.eclipse.jetty:jetty-server
Maven
 before 9.4.41, plus listed versions
7.0.0.M07.0.0.M17.0.0.M27.0.0.M37.0.0.M4
Show 45 moreShow less
7.0.0.RC07.0.0.RC17.0.0.RC27.0.0.RC37.0.0.RC47.0.0.RC57.0.0.RC67.0.0.v200910057.0.1.v200911257.0.2.RC07.0.2.v201003317.1.0.RC07.1.0.RC17.1.0.v201005057.1.1.v201005177.1.2.v201005237.1.3.v201005267.1.4.v201006107.1.5.v201007057.1.6.v201007157.2.0.RC07.2.0.v201010207.2.1.v201011117.2.2.v201012057.3.0.v201102037.3.1.v201103077.4.0.RC07.4.0.v201104147.4.1.v201105137.4.2.v201105267.4.3.v201107017.4.4.v201107077.4.5.v201107257.5.0.RC07.5.0.RC17.5.0.RC27.5.0.v201109017.5.1.v201109087.5.2.v201110067.5.3.v201110117.5.4.v201110247.6.0.RC07.6.0.RC17.6.0.RC27.6.0.RC3
9.4.41
org.eclipse.jetty:jetty-server
Maven
 10.0.0 up to 10.0.3, plus listed versions
10.0.110.0.2
10.0.3
org.eclipse.jetty:jetty-server
Maven
 11.0.0 up to 11.0.3, plus listed versions
11.0.111.0.2
11.0.3
jetty
openEuler:20.03-LTS-SP1
 before 9.4.15-9.oe1
9.4.15-9.oe1
coreos-installer
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
coreos-installer-bootinfra
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
coreos-installer-bootinfra-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
coreos-installer-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
coreos-installer-debugsource
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:0.10.0-2.rhaos4.9.el8
0:0.10.0-2.rhaos4.9.el8
jenkins
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.289.3.1630554997-1.el8
0:2.289.3.1630554997-1.el8
openshift
Red Hat:openshift:4.9::el7
From an advisory covering 5 CVEs
 before 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
openshift-hyperkube
Red Hat:openshift:4.9::el7
From an advisory covering 5 CVEs
 before 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el7
openshift
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
openshift-hyperkube
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
0:4.9.0-202110080828.p0.git.894a78b.assembly.stream.el8
network-scripts-openvswitch2.15
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-debugsource
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-devel
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-ipsec
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
openvswitch2.15-test
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
python3-openvswitch2.15
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
python3-openvswitch2.15-debuginfo
Red Hat:openshift:4.9::el8
From an advisory covering 5 CVEs
 before 0:2.15.0-28.el8fdp
0:2.15.0-28.el8fdp
jetty
Ubuntu:14.04:LTS
 All versions, plus listed versions
6.1.26-1ubuntu16.1.26-1ubuntu1.16.1.26-1ubuntu1.2
 None known
jetty8
Ubuntu:14.04:LTS
 All versions, plus listed versions
8.1.3-88.1.3-9
 None known
jetty
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.1.26-56.1.26-5ubuntu0.1
 None known
jetty8
Ubuntu:16.04:LTS
 All versions, plus listed versions
8.1.17-28.1.18-18.1.18-28.1.18-38.1.19-1
 None known
jetty9
Ubuntu:16.04:LTS
 All versions, plus listed versions
9.2.14-1
 None known
jetty9
Ubuntu:18.04:LTS
 All versions, plus listed versions
9.2.22-29.2.22-39.2.23-19.4.15-1~18.04.1ubuntu1
 None known
jetty9
Ubuntu:20.04:LTS
 All versions, plus listed versions
9.4.18-2build29.4.26-1
 None known

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
SourceLinkDate
PoC in GitHubTrinadh465/jetty_9.4.31_CVE-2021-344282023-11-01

History

History
RecordedChangedSources
affected, facts
aliases, productsEUVD
first indexedCVE List, GitHub Advisories, NVD, OSV, PoC in GitHub

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2021-34428 is a low vulnerability (CVSS 2.9) in Eclipse Jetty, published June 22, 2021. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 0.96%, the 61st percentile. Fixed in org.eclipse.jetty:jetty-server 9.4.41.

References

Show 44 moreShow less
This page doesn't list everything

Left out here: 238 versions. The JSON record has them.

Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open