CVE-2022-2047
Jetty invalid URI parsing may produce invalid HttpURI.authority
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
Attack profile
How easy it is to exploit
- Attack vector
- Network
- Complexity
- Low
- Privileges needed
- High
- User interaction
- None
What an attacker can affect
- Confidentiality
- None
- Integrity
- Low
- Availability
- None
Exploit likelihood
What each source reports
CVE List Score used
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
- Record
CVE-2022-2047- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
EUVDEUVD-2022-6317
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
- Record
EUVD-2022-6317- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
GitHub AdvisoriesGHSA-cj7v-27pg-wf7q
Jetty invalid URI parsing may produce invalid HttpURI.authority
Description
URI use within Jetty's HttpURI class can parse invalid URIs such as http://localhost;/path as having an authority with a host of localhost;.
A URIs of the type http://localhost;/path should be interpreted to be either invalid or as localhost; to be the userinfo and no host.
However, HttpURI.host returns localhost; which is definitely wrong.
Impact
This can lead to errors with Jetty's HttpClient, and Jetty's ProxyServlet / AsyncProxyServlet / AsyncMiddleManServlet wrongly interpreting an authority with no host as one with a host.
Patches
Patched in PR #8146 for Jetty version 9.4.47. Patched in PR #8014 for Jetty versions 10.0.10, and 11.0.10
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected].
- Record
GHSA-cj7v-27pg-wf7q- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
NVD
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
- Record
CVE-2022-2047- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - CVSS 2.0
- 4.0 Medium
AV:N/AC:L/Au:S/C:N/I:P/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSV
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
- Record
CVE-2022-2047- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2022-2047
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
- Record
DEBIAN-CVE-2022-2047- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-03
Show 7 moreShow less
OSVGHSA-cj7v-27pg-wf7q
Jetty invalid URI parsing may produce invalid HttpURI.authority
Description
URI use within Jetty's HttpURI class can parse invalid URIs such as http://localhost;/path as having an authority with a host of localhost;.
A URIs of the type http://localhost;/path should be interpreted to be either invalid or as localhost; to be the userinfo and no host.
However, HttpURI.host returns localhost; which is definitely wrong.
Impact
This can lead to errors with Jetty's HttpClient, and Jetty's ProxyServlet / AsyncProxyServlet / AsyncMiddleManServlet wrongly interpreting an authority with no host as one with a host.
Patches
Patched in PR #8146 for Jetty version 9.4.47. Patched in PR #8014 for Jetty versions 10.0.10, and 11.0.10
Workarounds
None.
For more information
If you have any questions or comments about this advisory:
- Email us at [email protected].
- Record
GHSA-cj7v-27pg-wf7q- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Weakness
- CWE-20
- Updated
- 2026-11-02
OSVOESA-2023-1021
jetty security update
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server (like Apache) in order to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate server/container solutions, this means that your web server and web application run in the same process, without interconnection overheads and complications. Furthermore, as a pure java component, Jetty can be simply included in your application for demonstration, distribution or deployment. Jetty is available on all Java supported platforms.
Security Fix(es):
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.(CVE-2022-2048)
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.(CVE-2022-2047)
- Record
OESA-2023-1021- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1030
jetty security update
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server (like Apache) in order to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate server/container solutions, this means that your web server and web application run in the same process, without interconnection overheads and complications. Furthermore, as a pure java component, Jetty can be simply included in your application for demonstration, distribution or deployment.Jetty is available on all Java supported platforms.
Security Fix(es):
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.(CVE-2022-2048)
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.(CVE-2022-2047)
- Record
OESA-2023-1030- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1031
jetty security update
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server (like Apache) in order to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate server/container solutions, this means that your web server and web application run in the same process, without interconnection overheads and complications. Furthermore, as a pure java component, Jetty can be simply included in your application for demonstration, distribution or deployment.Jetty is available on all Java supported platforms.
Security Fix(es):
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.(CVE-2022-2048)
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.(CVE-2022-2047)
- Record
OESA-2023-1031- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVOESA-2023-1032
jetty security update
Jetty is a 100% Java HTTP Server and Servlet Container. This means that you do not need to configure and run a separate web server (like Apache) in order to use Java, servlets and JSPs to generate dynamic content. Jetty is a fully featured web server for static and dynamic content. Unlike separate server/container solutions, this means that your web server and web application run in the same process, without interconnection overheads and complications. Furthermore, as a pure java component, Jetty can be simply included in your application for demonstration, distribution or deployment.Jetty is available on all Java supported platforms.
Security Fix(es):
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.(CVE-2022-2048)
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.(CVE-2022-2047)
- Record
OESA-2023-1032- CVSS 3.1
- 7.5 High
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H - Updated
- 2026-11-02
OSVUBUNTU-CVE-2022-2047
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
- Record
UBUNTU-CVE-2022-2047- CVSS 3.1
- 2.7 Low
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N - Updated
- 2026-11-02
OSVopenSUSE-SU-2024:12182-1 No score
jetty-annotations-9.4.48-1.1 on GA media
These are all security issues fixed in the jetty-annotations-9.4.48-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:12182-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty:jetty-httpMaven |
before 9.4.47 | 9.4.47 |
org.eclipse.jetty:jetty-httpMaven |
10.0.0 up to 10.0.10 | 10.0.10 |
org.eclipse.jetty:jetty-httpMaven |
11.0.0 up to 11.0.10 | 11.0.10 |
jetty9Debian:12 |
before 9.4.48-1 | 9.4.48-1 |
jetty9Debian:13 |
before 9.4.48-1 | 9.4.48-1 |
jetty9Debian:14 |
before 9.4.48-1 | 9.4.48-1 |
jetty9Debian:10 |
before 9.4.16-0+deb10u2, plus listed versions 9.4.15-19.4.16-0+deb10u1 |
9.4.16-0+deb10u2 |
jetty9Debian:11 |
before 9.4.39-3+deb11u1, plus listed versions 9.4.39-3 |
9.4.39-3+deb11u1 |
org.eclipse.jetty:jetty-httpMaven |
before 9.4.47, plus listed versions 7.0.0.M07.0.0.M17.0.0.M27.0.0.M37.0.0.M4 Show 45 moreShow less7.0.0.RC07.0.0.RC17.0.0.RC27.0.0.RC37.0.0.RC47.0.0.RC57.0.0.RC67.0.0.v200910057.0.1.v200911257.0.2.RC07.0.2.v201003317.1.0.RC07.1.0.RC17.1.0.v201005057.1.1.v201005177.1.2.v201005237.1.3.v201005267.1.4.v201006107.1.5.v201007057.1.6.v201007157.2.0.RC07.2.0.v201010207.2.1.v201011117.2.2.v201012057.3.0.v201102037.3.1.v201103077.4.0.RC07.4.0.v201104147.4.1.v201105137.4.2.v201105267.4.3.v201107017.4.4.v201107077.4.5.v201107257.5.0.RC07.5.0.RC17.5.0.RC27.5.0.v201109017.5.1.v201109087.5.2.v201110067.5.3.v201110117.5.4.v201110247.6.0.RC07.6.0.RC17.6.0.RC27.6.0.RC3 |
9.4.47 |
org.eclipse.jetty:jetty-httpMaven |
10.0.0 up to 10.0.10, plus listed versions 10.0.110.0.210.0.310.0.410.0.5 Show 4 moreShow less10.0.610.0.710.0.810.0.9 |
10.0.10 |
Show 13 moreShow less
| Package | Affected | Fixed |
|---|---|---|
org.eclipse.jetty:jetty-httpMaven |
11.0.0 up to 11.0.10, plus listed versions 11.0.111.0.211.0.311.0.411.0.5 Show 4 moreShow less11.0.611.0.711.0.811.0.9 |
11.0.10 |
jettyopenEuler:22.03-LTS-SP1 |
before 9.4.16-3.oe2203sp1 | 9.4.16-3.oe2203sp1 |
jettyopenEuler:20.03-LTS-SP1 |
before 9.4.16-3.oe1 | 9.4.16-3.oe1 |
jettyopenEuler:20.03-LTS-SP3 |
before 9.4.16-3.oe1 | 9.4.16-3.oe1 |
jettyopenEuler:22.03-LTS |
before 9.4.16-3.oe2203 | 9.4.16-3.oe2203 |
jettyUbuntu:14.04:LTS |
All versions, plus listed versions 6.1.26-1ubuntu16.1.26-1ubuntu1.16.1.26-1ubuntu1.2 |
None known |
jetty8Ubuntu:14.04:LTS |
All versions, plus listed versions 8.1.3-88.1.3-9 |
None known |
jettyUbuntu:16.04:LTS |
All versions, plus listed versions 6.1.26-56.1.26-5ubuntu0.1 |
None known |
jetty8Ubuntu:16.04:LTS |
All versions, plus listed versions 8.1.17-28.1.18-18.1.18-28.1.18-38.1.19-1 |
None known |
jetty9Ubuntu:16.04:LTS |
All versions, plus listed versions 9.2.14-1 |
None known |
jetty9Ubuntu:18.04:LTS |
All versions, plus listed versions 9.2.22-29.2.22-39.2.23-19.4.15-1~18.04.1ubuntu1 |
None known |
jetty9Ubuntu:20.04:LTS |
All versions, plus listed versions 9.4.18-2build29.4.26-1 |
None known |
jetty9Ubuntu:22.04:LTS |
All versions, plus listed versions 9.4.39-39.4.44-29.4.44-39.4.44-49.4.45-1 |
None known |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases, products | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2022-2047 is a low vulnerability (CVSS 2.7) in Eclipse Jetty, published July 7, 2022. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 1.32%, the 71st percentile. Fixed in org.eclipse.jetty:jetty-http 9.4.47.
References
github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
debian.org/security/2022/dsa-5198
lists.debian.org/debian-lts-announce/2022/08/msg00011.html
security.netapp.com/advisory/ntap-20220901-0006
nvd.nist.gov/vuln/detail/CVE-2022-2047
Show 13 moreShow less
security-tracker.debian.org/tracker/CVE-2022-2047
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1021
ubuntu.com/security/CVE-2022-2047
cve.org/CVERecord?id=CVE-2022-2047
suse.com/security/cve/CVE-2022-2047
Left out here: 244 versions. The JSON record has them.