{"id":"CVE-2011-4461","aliases":["EUVD-2022-5062","GHSA-qxp4-27vx-xmm3","UBUNTU-CVE-2011-4461"],"status":"published","title":"Improper Input Validation in Jetty","description":"Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","severity":{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.04922,"percentile":0.92178,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20","CWE-310"],"published":"2011-12-29T00:00:00Z","modified":"2026-06-16T23:34:55Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["8.1.0.RC4"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"8.1.0.RC2"},{"fixed":"8.1.0.RC4"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"8.1.0.RC4"}]}],"versions":["7.0.0.M0","7.0.0.M1","7.0.0.M2","7.0.0.M3","7.0.0.M4","7.0.0.RC0","7.0.0.RC1","7.0.0.RC2","7.0.0.RC3","7.0.0.RC4","7.0.0.RC5","7.0.0.RC6","7.0.0.v20091005","7.0.1.v20091125","7.0.2.RC0","7.0.2.v20100331","7.1.0.RC0","7.1.0.RC1","7.1.0.v20100505","7.1.1.v20100517","7.1.2.v20100523","7.1.3.v20100526","7.1.4.v20100610","7.1.5.v20100705","7.1.6.v20100715","7.2.0.RC0","7.2.0.v20101020","7.2.1.v20101111","7.2.2.v20101205","7.3.0.v20110203","7.3.1.v20110307","7.4.0.RC0","7.4.0.v20110414","7.4.1.v20110513","7.4.2.v20110526","7.4.3.v20110701","7.4.4.v20110707","7.4.5.v20110725","7.5.0.RC0","7.5.0.RC1","7.5.0.RC2","7.5.0.v20110901","7.5.1.v20110908","7.5.2.v20111006","7.5.3.v20111011","7.5.4.v20111024","7.6.0.RC0","7.6.0.RC1","7.6.0.RC2","7.6.0.RC3","7.6.0.RC4","7.6.0.RC5","7.6.0.v20120127","7.6.1.v20120215","7.6.10.v20130312","7.6.11.v20130520","7.6.12.v20130726","7.6.13.v20130916","7.6.14.v20131031","7.6.15.v20140411","7.6.16.v20140903","7.6.17.v20150415","7.6.18.v20150929","7.6.19.v20160209","7.6.2.v20120308","7.6.20.v20160902","7.6.21.v20160908","7.6.3.v20120416","7.6.4.v20120524","7.6.5.v20120716","7.6.6.v20120903","7.6.7.v20120910","7.6.8.v20121106","7.6.9.v20130131","8.0.0.M0","8.0.0.M1","8.0.0.M2","8.0.0.M3","8.0.0.RC0","8.0.0.v20110901","8.0.1.v20110908","8.0.2.v20111006","8.0.3.v20111011","8.0.4.v20111024","8.1.0.RC0","8.1.0.RC1","8.1.0.RC2"]}],"products":[{"vendor":"mortbay","product":"jetty"},{"vendor":"oracle","product":"sun_storage_common_array_manager"}],"references":[{"url":"http://marc.info/?l=bugtraq\u0026m=143387688830075\u0026w=2","tags":["vendor-advisory","x_refsource_HP","x_transferred","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190307-0004/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.ubuntu.com/usn/USN-1429-1","tags":["vendor-advisory","x_refsource_UBUNTU","x_transferred","web"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpujul2018-4258247.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.nruns.com/_downloads/advisory28122011.pdf","tags":["x_refsource_MISC","x_transferred","report"]},{"url":"http://secunia.com/advisories/48981","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.oracle.com/technetwork/topics/security/cpujan2015-1972971.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"http://www.securitytracker.com/id?1026475","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"]},{"url":"http://www.kb.cert.org/vuls/id/903934","tags":["third-party-advisory","x_refsource_CERT-VN","x_transferred","US Government Resource","web","report"]},{"url":"http://www.oracle.com/technetwork/security-advisory/cpuapr2016v3-2985753.html","tags":["x_refsource_CONFIRM","x_transferred","web"]},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/72017","tags":["vdb-entry","x_refsource_XF","x_transferred","web"]},{"url":"http://archives.neohapsis.com/archives/bugtraq/2011-12/0181.html","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"]},{"url":"http://secunia.com/advisories/47408","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"]},{"url":"http://www.ocert.org/advisories/ocert-2011-003.html","tags":["x_refsource_MISC","x_transferred","web","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2011-4461","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/commit/085c79d7d6cfbccc02821ffdb64968593df3e0bf","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20190307-0004","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qxp4-27vx-xmm3"},{"url":"https://github.com/eclipse/jetty.project","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2011-4461","tags":["report"]},{"url":"http://dev.eclipse.org/mhonarc/lists/jetty-users/msg01818.html","tags":["report"]},{"url":"https://ubuntu.com/security/notices/USN-1429-1","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2011-4461","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2011-4461","description":"Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","status":"published","published":"2011-12-30T01:00:00Z","modified":"2024-08-07T00:09:18.436Z","updated_at":"2026-11-02T14:35:37.989579Z"}],"euvd":[{"id":"EUVD-2022-5062","description":"Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","status":"published","published":"2011-12-30T01:00:00Z","modified":"2024-08-07T00:09:18Z","updated_at":"2026-11-03T01:39:48.961231Z"}],"ghsa":[{"id":"GHSA-qxp4-27vx-xmm3","title":"Improper Input Validation in Jetty","description":"Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","status":"published","published":"2022-05-14T01:27:35Z","modified":"2024-04-19T19:00:13Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:37:43.62603Z"}],"nvd":[{"id":"CVE-2011-4461","description":"Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","status":"published","published":"2011-12-30T01:55:01.313Z","modified":"2026-06-16T23:34:55.597Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:N/I:N/A:P","level":"medium","assessor":"primary"}],"cwes":["CWE-310"],"updated_at":"2026-11-02T14:02:11.800512Z"}],"osv":[{"id":"GHSA-qxp4-27vx-xmm3","title":"Improper Input Validation in Jetty","description":"Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","status":"published","published":"2022-05-14T01:27:35Z","modified":"2024-04-19T19:16:17.73217Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:55.122811Z"},{"id":"UBUNTU-CVE-2011-4461","description":"Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.","status":"withdrawn","published":"2011-12-29T00:00:00Z","modified":"2026-02-04T04:15:51.938399Z","cvss":[{"version":"3.0","score":5.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L","level":"medium"}],"updated_at":"2026-11-02T15:54:06.395274Z"}]}}