{"id":"CVE-2019-17632","aliases":["DEBIAN-CVE-2019-17632","EUVD-2019-0779","GHSA-5h9j-q6j2-253f","UBUNTU-CVE-2019-17632"],"status":"published","title":"Unescaped exception messages in error responses in Jetty","description":"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","severity":{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-10","score":0.01905,"percentile":0.79894,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-79"],"published":"2019-11-25T21:56:15Z","modified":"2026-10-24T10:30:49Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["9.4.24.v20191120"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"jetty9","fixed_in":["9.4.26-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jetty9","fixed_in":["9.4.26-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty9","fixed_in":["9.4.26-1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.21.v20190926"},{"last_affected":"9.4.21.v20190926"},{"fixed":"9.4.24.v20191120"}]}],"versions":["9.4.21.v20190926"]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.22.v20191022"},{"last_affected":"9.4.22.v20191022"},{"fixed":"9.4.24.v20191120"}]}],"versions":["9.4.22.v20191022"]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.23.v20191118"},{"last_affected":"9.4.23.v20191118"},{"fixed":"9.4.24.v20191120"}]}],"versions":["9.4.23.v20191118"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.26-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.26-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.26-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.21.v20190926"},{"fixed":"9.4.24.v20191120"}]}],"versions":["9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.22.v20191022"},{"fixed":"9.4.24.v20191120"}]}],"versions":["9.4.22.v20191022","9.4.23.v20191118"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.23.v20191118"},{"fixed":"9.4.24.v20191120"}]}],"versions":["9.4.23.v20191118"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-1ubuntu1","6.1.26-1ubuntu1.1","6.1.26-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jetty8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.1.3-8","8.1.3-9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-5","6.1.26-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty8","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["8.1.17-2","8.1.18-1","8.1.18-2","8.1.18-3","8.1.19-1"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"the eclipse foundation","product":"eclipse jetty"}],"references":[{"url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/","tags":["vendor-advisory","x_refsource_FEDORA","x_transferred","web"]},{"url":"https://www.oracle.com/security-alerts/cpuoct2020.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=553443","tags":["x_refsource_CONFIRM","x_transferred","Issue Tracking","Vendor Advisory","report","web"]},{"url":"https://www.oracle.com/security-alerts/cpuApr2021.html","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2019-17632","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS/"},{"url":"https://github.com/advisories/GHSA-5h9j-q6j2-253f"},{"url":"https://security-tracker.debian.org/tracker/CVE-2019-17632","tags":["advisory"]},{"url":"https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2019-17632","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2019-17632","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2019-17632","description":"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","status":"published","published":"2019-11-25T21:56:15Z","modified":"2024-08-05T01:47:13.488Z","cwes":["CWE-79"],"updated_at":"2026-11-02T14:20:24.678649Z"}],"euvd":[{"id":"EUVD-2019-0779","description":"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","status":"published","published":"2019-11-25T21:56:15Z","modified":"2024-08-05T01:47:13Z","updated_at":"2026-11-03T02:40:29.306082Z"}],"ghsa":[{"id":"GHSA-5h9j-q6j2-253f","title":"Unescaped exception messages in error responses in Jetty","description":"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","status":"published","published":"2019-12-02T18:13:28Z","modified":"2023-02-01T05:02:40Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:36:31.364752Z"}],"nvd":[{"id":"CVE-2019-17632","description":"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","status":"published","published":"2019-11-25T22:15:11.437Z","modified":"2026-06-17T02:24:18.697Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium","assessor":"primary"},{"version":"2.0","score":4.3,"vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T14:05:38.993437Z"}],"osv":[{"id":"CVE-2019-17632","description":"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","status":"published","published":"2019-11-25T22:15:11.437Z","modified":"2026-10-24T10:30:49.085632367Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:44:11.673963Z"},{"id":"DEBIAN-CVE-2019-17632","description":"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","status":"published","published":"2019-11-25T22:15:11.437Z","modified":"2026-09-21T07:02:52.515748993Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:31.867036Z"},{"id":"GHSA-5h9j-q6j2-253f","title":"Unescaped exception messages in error responses in Jetty","description":"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","status":"published","published":"2019-12-02T18:13:28Z","modified":"2024-02-16T08:16:10.159901Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-79"],"updated_at":"2026-11-02T15:46:38.553953Z"},{"id":"UBUNTU-CVE-2019-17632","description":"In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.","status":"published","published":"2019-11-25T22:15:00Z","modified":"2025-10-24T04:47:56Z","cvss":[{"version":"3.1","score":6.1,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:54:20.325378Z"}]}}