CVE-2015-2080

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

7.5 HighPublic exploitFix available

CVE-2015-2080 is a high vulnerability (CVSS 7.5) in Eclipse Jetty, published October 7, 2016. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 75.4%, the 99th percentile. Fixed in org.eclipse.jetty:jetty-server 9.2.9.v20150224.

What does this mean?

Severity: 7.5 HighCVSS 3.0, NVD
Exploit chance: 75.4%EPSS, 99th percentile
Exploitation: None known2 public exploits
Fixed in: 9.2.9.v20150224org.eclipse.jetty:jetty-server +1 more

Description

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: High
Integrity: None
Availability: None

Exploit likelihood

75.4%Up 26.3 points since Feb 4, 2022

Affected products

Affected packages

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty:jetty-server` Maven	through 9.2.8.v20150217	9.2.9.v20150224
`org.eclipse.jetty:jetty-server` Maven	before 9.2.9.v20150224, plus listed versions 7.0.0.M07.0.0.M17.0.0.M27.0.0.M37.0.0.M4 Show 45 moreShow less 7.0.0.RC07.0.0.RC17.0.0.RC27.0.0.RC37.0.0.RC47.0.0.RC57.0.0.RC67.0.0.v200910057.0.1.v200911257.0.2.RC07.0.2.v201003317.1.0.RC07.1.0.RC17.1.0.v201005057.1.1.v201005177.1.2.v201005237.1.3.v201005267.1.4.v201006107.1.5.v201007057.1.6.v201007157.2.0.RC07.2.0.v201010207.2.1.v201011117.2.2.v201012057.3.0.v201102037.3.1.v201103077.4.0.RC07.4.0.v201104147.4.1.v201105137.4.2.v201105267.4.3.v201107017.4.4.v201107077.4.5.v201107257.5.0.RC07.5.0.RC17.5.0.RC27.5.0.v201109017.5.1.v201109087.5.2.v201110067.5.3.v201110117.5.4.v201110247.6.0.RC07.6.0.RC17.6.0.RC27.6.0.RC3	9.2.9.v20150224

Public exploits

Links only. Every CVE stores no exploit code.

Public exploits
Source	Link	Date
Exploit-DB	Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers	2016-02-17
Nuclei	Eclipse Jetty <9.2.9.v20150224 - Sensitive Information Leakage

What each source reports

NVD Score used7.5

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Record: CVE-2015-2080
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0: 5.0 MediumAV:N/AC:L/Au:N/C:P/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02

CVE ListNo score

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Record: CVE-2015-2080
Updated: 2026-11-02

EUVDEUVD-2018-0753No score

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Record: EUVD-2018-0753
Updated: 2026-11-03

GitHub AdvisoriesGHSA-ghgj-3xqr-6jfm7.5

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

The exception handling code in Eclipse Jetty prior to 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Record: GHSA-ghgj-3xqr-6jfm
CVSS 3.0: 7.5 HighCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Weakness: CWE-200
Updated: 2026-11-02