Every CVE Search/ Get API key

CVE-2024-7708

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

7.5 HighFix available

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.44%Up 0.2 points since Jul 14, 2026
90%50%10%1%

What each source reports

CVE List Score used 7.5

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Record
CVE-2024-7708
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-401
Updated
2026-11-02
EUVDEUVD-2024-55651 7.5

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Record
EUVD-2024-55651
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-9299-c6m4-mjhc 7.5

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Impact

The original report:

Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.

After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Affected Versions

  • Jetty 11.0.0-11.0.22 (EOL)
  • Jetty 10.0.0-10.0.22 (EOL)

Patched Versions

  • Jetty 11.0.23
  • Jetty 10.0.23

Patches

https://github.com/jetty/jetty.project/pull/12156

Workarounds

No workarounds.

Record
GHSA-9299-c6m4-mjhc
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-401
Updated
2026-11-02
NVD 7.5

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Record
CVE-2024-7708
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-401
Updated
2026-11-02
OSV 7.5

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Record
CVE-2024-7708
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-401
Updated
2026-11-02
OSVDEBIAN-CVE-2024-7708 7.5

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Record
DEBIAN-CVE-2024-7708
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVGHSA-9299-c6m4-mjhc 7.5

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Impact

The original report:

Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.

After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Affected Versions

  • Jetty 11.0.0-11.0.22 (EOL)
  • Jetty 10.0.0-10.0.22 (EOL)

Patched Versions

  • Jetty 11.0.23
  • Jetty 10.0.23

Patches

https://github.com/jetty/jetty.project/pull/12156

Workarounds

No workarounds.

Record
GHSA-9299-c6m4-mjhc
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400, CWE-401
Updated
2026-11-02
OSVUBUNTU-CVE-2024-7708 7.5

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Record
UBUNTU-CVE-2024-7708
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVCLSA-2026-1785292544 No score

TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)

TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 11.0.19-tuxcare.3.

Record
CLSA-2026-1785292544
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.eclipse.jetty:jetty-server
Maven
 10.0.7 up to 10.0.23
10.0.23
org.eclipse.jetty:jetty-server
Maven
 11.0.7 up to 11.0.23
11.0.23
org.eclipse.jetty:jetty-server
TuxCare:Maven
 11.0.19 up to 11.0.19-tuxcare.3, plus listed versions
11.0.19-tuxcare.111.0.19-tuxcare.2
11.0.19-tuxcare.3
jetty12
Debian:13
 All versions, plus listed versions
12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-212.0.33-1
 None known
jetty12
Debian:14
 All versions, plus listed versions
12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-212.0.33-1
 None known
jetty9
Debian:12
 All versions, plus listed versions
9.4.50-49.4.50-4+deb12u19.4.50-4+deb12u29.4.50-4+deb12u39.4.51-1
Show 13 moreShow less
9.4.51-29.4.52-19.4.53-19.4.54-19.4.55-19.4.56-19.4.57-0+deb12u19.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2
 None known
jetty9
Debian:13
 All versions, plus listed versions
9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2
 None known
jetty9
Debian:14
 All versions, plus listed versions
9.4.57-19.4.57-1.19.4.57-1.1~deb12u19.4.57-1.1~deb13u19.4.58-19.4.58-2
 None known
org.eclipse.jetty:jetty-server
Maven
 10.0.7 up to 10.0.23, plus listed versions
10.0.1010.0.1110.0.1210.0.1310.0.14
Show 10 moreShow less
10.0.1510.0.1610.0.1710.0.1810.0.1910.0.2010.0.2110.0.2210.0.810.0.9
10.0.23
org.eclipse.jetty:jetty-server
Maven
 11.0.7 up to 11.0.23, plus listed versions
11.0.1011.0.1111.0.1211.0.1311.0.14
Show 10 moreShow less
11.0.1511.0.1611.0.1711.0.1811.0.1911.0.2011.0.2111.0.2211.0.811.0.9
11.0.23
Show 9 moreShow less
Affected packages
PackageAffectedFixed
jetty9
Ubuntu:16.04:LTS
 All versions, plus listed versions
9.2.14-1
 None known
jetty9
Ubuntu:18.04:LTS
 All versions, plus listed versions
9.2.22-29.2.22-39.2.23-19.4.15-1~18.04.1ubuntu1
 None known
jetty9
Ubuntu:20.04:LTS
 All versions, plus listed versions
9.4.18-2build29.4.26-1
 None known
jetty9
Ubuntu:22.04:LTS
 All versions, plus listed versions
9.4.39-39.4.44-29.4.44-39.4.44-49.4.45-1
 None known
jetty9
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.4.51-29.4.53-1
 None known
jetty12
Ubuntu:26.10
 All versions, plus listed versions
12.0.32-1
 None known
jetty9
Ubuntu:26.10
 All versions, plus listed versions
9.4.58-19.4.58-2
 None known
jetty12
Ubuntu:26.04:LTS
 All versions, plus listed versions
12.0.17-3.112.0.32-1
 None known
jetty9
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.4.57-19.4.57-1.19.4.58-1
 None known

History

History
RecordedChangedSources
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2024-7708 is a high vulnerability (CVSS 7.5) in Eclipse Jetty, published July 14, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.44%, the 38th percentile. Fixed in org.eclipse.jetty:jetty-server 10.0.23.

References

Show 7 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open