{"id":"CVE-2015-2080","aliases":["EUVD-2018-0753","GHSA-ghgj-3xqr-6jfm"],"status":"published","title":"Jetty vulnerable to exposure of sensitive information to unauthenticated remote users","description":"The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.","severity":{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-07","score":0.75441,"percentile":0.99519,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-200"],"published":"2016-10-07T14:00:00Z","modified":"2026-06-17T00:23:33Z","exploits":[{"source":"exploitdb","id":"EDB-39455","title":"Inductive Automation Ignition 7.8.1 - Remote Leakage Of Shared Buffers","type":"remote","platform":"multiple","date":"2016-02-17","url":"https://www.exploit-db.com/exploits/39455"},{"source":"nuclei","id":"CVE-2015-2080","title":"Eclipse Jetty \u003c9.2.9.v20150224 - Sensitive Information Leakage","type":"detection template","url":"https://github.com/projectdiscovery/nuclei-templates/blob/main/http/cves/2015/CVE-2015-2080.yaml"}],"fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["9.2.9.v20150224"],"sources":["ghsa","osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.2.8.v20150217"},{"fixed":"9.2.9.v20150224"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.2.9.v20150224"}]}],"versions":["7.0.0.M0","7.0.0.M1","7.0.0.M2","7.0.0.M3","7.0.0.M4","7.0.0.RC0","7.0.0.RC1","7.0.0.RC2","7.0.0.RC3","7.0.0.RC4","7.0.0.RC5","7.0.0.RC6","7.0.0.v20091005","7.0.1.v20091125","7.0.2.RC0","7.0.2.v20100331","7.1.0.RC0","7.1.0.RC1","7.1.0.v20100505","7.1.1.v20100517","7.1.2.v20100523","7.1.3.v20100526","7.1.4.v20100610","7.1.5.v20100705","7.1.6.v20100715","7.2.0.RC0","7.2.0.v20101020","7.2.1.v20101111","7.2.2.v20101205","7.3.0.v20110203","7.3.1.v20110307","7.4.0.RC0","7.4.0.v20110414","7.4.1.v20110513","7.4.2.v20110526","7.4.3.v20110701","7.4.4.v20110707","7.4.5.v20110725","7.5.0.RC0","7.5.0.RC1","7.5.0.RC2","7.5.0.v20110901","7.5.1.v20110908","7.5.2.v20111006","7.5.3.v20111011","7.5.4.v20111024","7.6.0.RC0","7.6.0.RC1","7.6.0.RC2","7.6.0.RC3","7.6.0.RC4","7.6.0.RC5","7.6.0.v20120127","7.6.1.v20120215","7.6.10.v20130312","7.6.11.v20130520","7.6.12.v20130726","7.6.13.v20130916","7.6.14.v20131031","7.6.15.v20140411","7.6.16.v20140903","7.6.17.v20150415","7.6.18.v20150929","7.6.19.v20160209","7.6.2.v20120308","7.6.20.v20160902","7.6.21.v20160908","7.6.3.v20120416","7.6.4.v20120524","7.6.5.v20120716","7.6.6.v20120903","7.6.7.v20120910","7.6.8.v20121106","7.6.9.v20130131","8.0.0.M0","8.0.0.M1","8.0.0.M2","8.0.0.M3","8.0.0.RC0","8.0.0.v20110901","8.0.1.v20110908","8.0.2.v20111006","8.0.3.v20111011","8.0.4.v20111024","8.1.0.RC0","8.1.0.RC1","8.1.0.RC2","8.1.0.RC4","8.1.0.RC5","8.1.0.v20120127","8.1.1.v20120215","8.1.10.v20130312","8.1.11.v20130520","8.1.12.v20130726","8.1.13.v20130916","8.1.14.v20131031","8.1.15.v20140411","8.1.16.v20140903","8.1.17.v20150415","8.1.18.v20150929","8.1.19.v20160209","8.1.2.v20120308","8.1.20.v20160902","8.1.21.v20160908","8.1.22.v20160922","8.1.3.v20120416","8.1.4.v20120524","8.1.5.v20120716","8.1.6.v20120903","8.1.7.v20120910","8.1.8.v20121106","8.1.9.v20130131","8.2.0.v20160908","9.0.0.M0","9.0.0.M1","9.0.0.M2","9.0.0.M3","9.0.0.M4","9.0.0.M5","9.0.0.RC0","9.0.0.RC1","9.0.0.RC2","9.0.0.v20130308","9.0.1.v20130408","9.0.2.v20130417","9.0.3.v20130506","9.0.4.v20130625","9.0.5.v20130815","9.0.6.v20130930","9.0.7.v20131107","9.1.0.M0","9.1.0.RC0","9.1.0.RC1","9.1.0.RC2","9.1.0.v20131115","9.1.1.v20140108","9.1.2.v20140210","9.1.3.v20140225","9.1.4.v20140401","9.1.5.v20140505","9.1.6.v20160112","9.2.0.M0","9.2.0.M1","9.2.0.RC0","9.2.0.v20140526","9.2.1.v20140609","9.2.2.v20140723","9.2.3.v20140905","9.2.4.v20141103","9.2.5.v20141112","9.2.6.v20141205","9.2.7.v20150116","9.2.8.v20150217"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"fedoraproject","product":"fedora"}],"references":[{"url":"http://seclists.org/fulldisclosure/2015/Mar/12","tags":["mailing-list","x_refsource_FULLDISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","web"]},{"url":"http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html","tags":["mailing-list","x_refsource_MLIST","x_transferred","Vendor Advisory","web"]},{"url":"https://security.netapp.com/advisory/ntap-20190307-0005/","tags":["x_refsource_CONFIRM","x_transferred"]},{"url":"http://www.securityfocus.com/bid/72768","tags":["vdb-entry","x_refsource_BID","x_transferred","Broken Link","web"]},{"url":"https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Vendor Advisory","web"]},{"url":"http://www.securitytracker.com/id/1031800","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","Third Party Advisory","web"]},{"url":"http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html","tags":["x_refsource_MISC","x_transferred","Exploit","Third Party Advisory","web"]},{"url":"http://www.securityfocus.com/archive/1/534755/100/1600/threaded","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred","web"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","Third Party Advisory","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-2080","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-ghgj-3xqr-6jfm","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20190307-0005","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2015-2080","description":"The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.","status":"published","published":"2016-10-07T14:00:00Z","modified":"2024-08-06T05:02:43.318Z","updated_at":"2026-11-02T14:35:41.976732Z"}],"euvd":[{"id":"EUVD-2018-0753","description":"The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.","status":"published","published":"2016-10-07T14:00:00Z","modified":"2024-08-06T05:02:43Z","updated_at":"2026-11-03T02:22:12.830256Z"}],"ghsa":[{"id":"GHSA-ghgj-3xqr-6jfm","title":"Jetty vulnerable to exposure of sensitive information to unauthenticated remote users","description":"The exception handling code in Eclipse Jetty prior to 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.","status":"published","published":"2018-11-09T17:50:00Z","modified":"2023-01-08T05:02:40Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:36:01.39976Z"}],"nvd":[{"id":"CVE-2015-2080","description":"The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.","status":"published","published":"2016-10-07T14:59:00.193Z","modified":"2026-06-17T00:23:33.857Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high","assessor":"primary"},{"version":"2.0","score":5,"vector":"AV:N/AC:L/Au:N/C:P/I:N/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T14:03:16.97467Z"}],"osv":[{"id":"GHSA-ghgj-3xqr-6jfm","title":"Jetty vulnerable to exposure of sensitive information to unauthenticated remote users","description":"The exception handling code in Eclipse Jetty prior to 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.","status":"published","published":"2018-11-09T17:50:00Z","modified":"2024-02-16T08:18:50.53471Z","cvss":[{"version":"3.0","score":7.5,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N","level":"high"}],"cwes":["CWE-200"],"updated_at":"2026-11-02T15:46:47.822182Z"}]}}