CVE-2015-2080

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

7.5 HighPublic exploitFix available

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

75.4%Up 26.3 points since Feb 4, 2022

What each source reports

NVD Score used 7.5

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Record: CVE-2015-2080
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE List No score

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Record: CVE-2015-2080
Updated: 2026-11-02

EUVDEUVD-2018-0753 No score

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Record: EUVD-2018-0753
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ghgj-3xqr-6jfm 7.5

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

The exception handling code in Eclipse Jetty prior to 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Record: GHSA-ghgj-3xqr-6jfm
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

OSVGHSA-ghgj-3xqr-6jfm 7.5

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

Record: GHSA-ghgj-3xqr-6jfm
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty:jetty-server` Maven	through 9.2.8.v20150217	9.2.9.v20150224
`org.eclipse.jetty:jetty-server` Maven	before 9.2.9.v20150224, plus listed versions 7.0.0.M07.0.0.M17.0.0.M27.0.0.M37.0.0.M4 Show 45 moreShow less 7.0.0.RC07.0.0.RC17.0.0.RC27.0.0.RC37.0.0.RC47.0.0.RC57.0.0.RC67.0.0.v200910057.0.1.v200911257.0.2.RC07.0.2.v201003317.1.0.RC07.1.0.RC17.1.0.v201005057.1.1.v201005177.1.2.v201005237.1.3.v201005267.1.4.v201006107.1.5.v201007057.1.6.v201007157.2.0.RC07.2.0.v201010207.2.1.v201011117.2.2.v201012057.3.0.v201102037.3.1.v201103077.4.0.RC07.4.0.v201104147.4.1.v201105137.4.2.v201105267.4.3.v201107017.4.4.v201107077.4.5.v201107257.5.0.RC07.5.0.RC17.5.0.RC27.5.0.v201109017.5.1.v201109087.5.2.v201110067.5.3.v201110117.5.4.v201110247.6.0.RC07.6.0.RC17.6.0.RC27.6.0.RC3	9.2.9.v20150224

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers	2016-02-17
Nuclei	Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

History

History
Recorded	Changed	Sources
Nov 3, 2026	aliases	EUVD
Nov 2, 2026	first indexed	CVE List, Exploit-DB, GitHub Advisories, Nuclei, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2015-2080 is a high vulnerability (CVSS 7.5) in Eclipse Jetty, published October 7, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.4%, the 99th percentile. Fixed in org.eclipse.jetty:jetty-server 9.2.9.v20150224.

References

Show 7 moreShow less

This page doesn't list everything

Left out here: 103 versions. The JSON record has them.