{"id":"CVE-2024-6763","aliases":["CLSA-2026-1776040415","CLSA-2026-1779238058","CLSA-2026-1788878815","CLSA-2026-1790803421","CLSA-2026-1793770980","DEBIAN-CVE-2024-6763","EUVD-2024-3114","GHSA-qh8g-58pp-2wxh","ROOT-APP-MAVEN-CVE-2024-6763","SUSE-SU-2025:01738-1","UBUNTU-CVE-2024-6763","openSUSE-SU-2025:15160-1"],"status":"published","title":"Jetty URI parsing of invalid authority","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.","severity":{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00965,"percentile":0.61937,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-1286"],"published":"2024-10-14T15:06:07Z","modified":"2026-11-04T14:45:04Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","fixed_in":["12.0.12"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","fixed_in":["9.4.48.v20220622-tuxcare.5","9.4.41.v20210516-tuxcare.5"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-http","fixed_in":["11.0.26-aikido.3","12.0.3-aikido.7","12.0.3-aikido.8","12.0.3-aikido.9","11.0.26-aikido.4"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-http","fixed_in":["11.0.26-root.io.2","12.0.3-root.io.6","11.0.26-root.io.3","12.0.3-root.io.7","12.0.3-root.io.8","12.0.3-root.io.9","11.0.26-root.io.4"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"last_affected":"12.0.11"},{"fixed":"12.0.12"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.53.v20231009"},{"fixed":"9.4.53.v20231009-tuxcare.3"}]}],"versions":["9.4.53.v20231009","9.4.53.v20231009-tuxcare.1","9.4.53.v20231009-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-servlets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.53.v20231009"},{"fixed":"9.4.53.v20231009-tuxcare.3"}]}],"versions":["9.4.53.v20231009","9.4.53.v20231009-tuxcare.1","9.4.53.v20231009-tuxcare.2"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.26"},{"fixed":"11.0.26-tuxcare.1"}]}],"versions":["11.0.26"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.26"},{"fixed":"11.0.26-tuxcare.1"}]}],"versions":["11.0.26"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.5"}]}],"versions":["9.4.50.v20221201","9.4.50.v20221201-tuxcare.1","9.4.50.v20221201-tuxcare.2","9.4.50.v20221201-tuxcare.3","9.4.50.v20221201-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.5"}]}],"versions":["9.4.50.v20221201","9.4.50.v20221201-tuxcare.1","9.4.50.v20221201-tuxcare.2","9.4.50.v20221201-tuxcare.3","9.4.50.v20221201-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.5"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1","9.4.48.v20220622-tuxcare.2","9.4.48.v20220622-tuxcare.3","9.4.48.v20220622-tuxcare.4"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.5"}]}],"versions":["9.4.41.v20210516","9.4.41.v20210516-tuxcare.1","9.4.41.v20210516-tuxcare.2","9.4.41.v20210516-tuxcare.3","9.4.41.v20210516-tuxcare.4"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"12.0.12"}]}],"versions":["10.0.0","10.0.0-alpha0","10.0.0.alpha1","10.0.0.alpha2","10.0.0.beta0","10.0.0.beta1","10.0.0.beta2","10.0.0.beta3","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.26","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9","11.0.0","11.0.0-alpha0","11.0.0.beta1","11.0.0.beta2","11.0.0.beta3","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.26","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9","12.0.0","12.0.0.alpha0","12.0.0.alpha1","12.0.0.alpha2","12.0.0.alpha3","12.0.0.beta0","12.0.0.beta1","12.0.0.beta2","12.0.0.beta3","12.0.0.beta4","12.0.1","12.0.10","12.0.11","12.0.2","12.0.3","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9","7.0.0.v20091005","7.0.1.v20091125","7.0.2.RC0","7.0.2.v20100331","7.1.0.RC0","7.1.0.RC1","7.1.0.v20100505","7.1.1.v20100517","7.1.2.v20100523","7.1.3.v20100526","7.1.4.v20100610","7.1.5.v20100705","7.1.6.v20100715","7.2.0.RC0","7.2.0.v20101020","7.2.1.v20101111","7.2.2.v20101205","7.3.0.v20110203","7.3.1.v20110307","7.4.0.RC0","7.4.0.v20110414","7.4.1.v20110513","7.4.2.v20110526","7.4.3.v20110701","7.4.4.v20110707","7.4.5.v20110725","7.5.0.RC0","7.5.0.RC1","7.5.0.RC2","7.5.0.v20110901","7.5.1.v20110908","7.5.2.v20111006","7.5.3.v20111011","7.5.4.v20111024","7.6.0.RC0","7.6.0.RC1","7.6.0.RC2","7.6.0.RC3","7.6.0.RC4","7.6.0.RC5","7.6.0.v20120127","7.6.1.v20120215","7.6.10.v20130312","7.6.11.v20130520","7.6.12.v20130726","7.6.13.v20130916","7.6.14.v20131031","7.6.15.v20140411","7.6.16.v20140903","7.6.17.v20150415","7.6.18.v20150929","7.6.19.v20160209","7.6.2.v20120308","7.6.20.v20160902","7.6.21.v20160908","7.6.3.v20120416","7.6.4.v20120524","7.6.5.v20120716","7.6.6.v20120903","7.6.7.v20120910","7.6.8.v20121106","7.6.9.v20130131","8.0.0.M0","8.0.0.M1","8.0.0.M2","8.0.0.M3","8.0.0.RC0","8.0.0.v20110901","8.0.1.v20110908","8.0.2.v20111006","8.0.3.v20111011","8.0.4.v20111024","8.1.0.RC0","8.1.0.RC1","8.1.0.RC2","8.1.0.RC4","8.1.0.RC5","8.1.0.v20120127","8.1.1.v20120215","8.1.10.v20130312","8.1.11.v20130520","8.1.12.v20130726","8.1.13.v20130916","8.1.14.v20131031","8.1.15.v20140411","8.1.16.v20140903","8.1.17.v20150415","8.1.18.v20150929","8.1.19.v20160209","8.1.2.v20120308","8.1.20.v20160902","8.1.21.v20160908","8.1.22.v20160922","8.1.3.v20120416","8.1.4.v20120524","8.1.5.v20120716","8.1.6.v20120903","8.1.7.v20120910","8.1.8.v20121106","8.1.9.v20130131","8.2.0.v20160908","9.0.0.M0","9.0.0.M1","9.0.0.M2","9.0.0.M3","9.0.0.M4","9.0.0.M5","9.0.0.RC0","9.0.0.RC1","9.0.0.RC2","9.0.0.v20130308","9.0.1.v20130408","9.0.2.v20130417","9.0.3.v20130506","9.0.4.v20130625","9.0.5.v20130815","9.0.6.v20130930","9.0.7.v20131107","9.1.0.M0","9.1.0.RC0","9.1.0.RC1","9.1.0.RC2","9.1.0.v20131115","9.1.1.v20140108","9.1.2.v20140210","9.1.3.v20140225","9.1.4.v20140401","9.1.5.v20140505","9.1.6.v20160112","9.2.0.M0","9.2.0.M1","9.2.0.RC0","9.2.0.v20140526","9.2.1.v20140609","9.2.10.v20150310","9.2.11.M0","9.2.11.v20150529","9.2.12.M0","9.2.12.v20150709","9.2.13.v20150730","9.2.14.v20151106","9.2.15.v20160210","9.2.16.v20160414","9.2.17.v20160517","9.2.18.v20160721","9.2.19.v20160908","9.2.2.v20140723","9.2.20.v20161216","9.2.21.v20170120","9.2.22.v20170606","9.2.23.v20171218","9.2.24.v20180105","9.2.25.v20180606","9.2.26.v20180806","9.2.27.v20190403","9.2.28.v20190418","9.2.29.v20191105","9.2.3.v20140905","9.2.30.v20200428","9.2.4.v20141103","9.2.5.v20141112","9.2.6.v20141205","9.2.7.v20150116","9.2.8.v20150217","9.2.9.v20150224","9.3.0.M0","9.3.0.M1","9.3.0.M2","9.3.0.RC0","9.3.0.RC1","9.3.0.v20150612","9.3.1.v20150714","9.3.10.M0","9.3.10.v20160621","9.3.11.M0","9.3.11.v20160721","9.3.12.v20160915","9.3.13.M0","9.3.13.v20161014","9.3.14.v20161028","9.3.15.v20161220","9.3.16.v20170120","9.3.17.RC0","9.3.17.v20170317","9.3.18.v20170406","9.3.19.v20170502","9.3.2.v20150730","9.3.20.v20170531","9.3.21.M0","9.3.21.RC0","9.3.21.v20170918","9.3.22.v20171030","9.3.23.v20180228","9.3.24.v20180605","9.3.25.v20180904","9.3.26.v20190403","9.3.27.v20190418","9.3.28.v20191105","9.3.29.v20201019","9.3.3.v20150827","9.3.30.v20211001","9.3.4.RC0","9.3.4.RC1","9.3.4.v20151007","9.3.5.v20151012","9.3.6.v20151106","9.3.7.RC0","9.3.7.RC1","9.3.7.v20160115","9.3.8.RC0","9.3.8.v20160314","9.3.9.M0","9.3.9.M1","9.3.9.v20160517","9.4.0.M0","9.4.0.M1","9.4.0.RC0","9.4.0.RC1","9.4.0.RC2","9.4.0.RC3","9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.53.v20231009","9.4.54.v20240208","9.4.55.v20240627","9.4.56.v20240826","9.4.57.v20241219","9.4.58.v20250814","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.26-aikido.3"},{"fixed":"12.0.3-aikido.7"},{"fixed":"12.0.3-aikido.8"},{"fixed":"12.0.3-aikido.9"},{"fixed":"11.0.26-aikido.4"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"11.0.26-root.io.2"},{"fixed":"12.0.3-root.io.6"},{"fixed":"11.0.26-root.io.3"},{"fixed":"12.0.3-root.io.7"},{"fixed":"12.0.3-root.io.8"},{"fixed":"12.0.3-root.io.9"},{"fixed":"11.0.26-root.io.4"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-150200.3.31.1"}]}],"bundled":2},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-1ubuntu1","6.1.26-1ubuntu1.1","6.1.26-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-5","6.1.26-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-1.1"}]}],"bundled":2}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"jetty"}],"references":[{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh","tags":["Exploit","Mitigation","Vendor Advisory","advisory","web","report"]},{"url":"https://gitlab.eclipse.org/security/cve-assignement/-/issues/25","tags":["Vendor Advisory","report","web"]},{"url":"https://github.com/jetty/jetty.project/pull/12012","tags":["Patch","Third Party Advisory","fix","web","report"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0005/","tags":["Third Party Advisory","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-6763","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250306-0005","tags":["web"]},{"url":"https://github.com/advisories/GHSA-qh8g-58pp-2wxh"},{"url":"https://repo.maven.apache.org/maven2/","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/6xxx/CVE-2024-6763.json","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-6763","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202501738-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1231652","tags":["report"]},{"url":"https://bugzilla.suse.com/1243271","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-13009","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-6763","tags":["web"]},{"url":"https://ubuntu.com/security/CVE-2024-6763","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-6763","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/YHGGC7B6PWN2UBH367C4SXP6PWNDYAXM/","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2024-6763","title":"Jetty URI parsing of invalid authority","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.","status":"published","published":"2024-10-14T15:06:07.298Z","modified":"2025-03-07T00:10:46.301Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"cna"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T14:34:11.305983Z"}],"euvd":[{"id":"EUVD-2024-3114","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.","status":"published","published":"2024-10-14T15:06:07Z","modified":"2025-03-07T00:10:46Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-02T20:53:10.661676Z"}],"ghsa":[{"id":"GHSA-qh8g-58pp-2wxh","title":"Eclipse Jetty URI parsing of invalid authority","description":"## Summary\n\nEclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, `HttpURI`, for URI/URL parsing.\n\nThe `HttpURI` class does insufficient validation on the authority segment of a URI.  However the behaviour of `HttpURI` differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC.  Specifically `HttpURI` and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.\n\n## Details\n\n### Affected components\n\nThe vulnerable component is the `HttpURI` class when used as a utility class in an application.  The Jetty usage of the class is not vulnerable.\n\n### Attack overview\n\nThe `HttpURI` class does not well validate the authority section of a URI. When presented with an illegal authority that may contain user info (eg username:password#@hostname:port), then the parsing of the URI is not failed.  Moreover, the interpretation of what part of the authority is the host name differs from a common browser in  that they also do not fail, but they select a different host name from the illegal URI.\n\n### Attack scenario\n\nA typical attack scenario is illustrated in the diagram below. The Validator checks whether the attacker-supplied URL is on the blocklist. If not, the URI is passed to the Requester for redirection. The Requester is responsible for sending requests to the hostname specified by the URI.\n\nThis attack occurs when the Validator is the `org.eclipse.jetty.http.HttpURI` class and the Requester is the `Browser` (include chrome, firefox and Safari). An attacker can send a malformed URI to the Validator (e.g., `http://browser.check%23%40vulndetector.com/` ). After validation, the Validator finds that the hostname is not on the blocklist. However, the Requester can still send requests to the domain with the hostname `vulndetector.com`.\n\n## PoC\n\npayloads:\n\n```\nhttp://browser.check \u0026@vulndetector.com/\nhttp://browser.check #@vulndetector.com/\nhttp://browser.check?@vulndetector.com/\nhttp://browser.check#@vulndetector.com/\nhttp://vulndetector.com\\\\/\n```\n\nThe problem of 302 redirect parsing in HTML tag scenarios. Below is a poc example. After clicking the button, the browser will open \"browser.check\", and jetty will parse this URL as \"vulndetector.com\".\n\n```\n\u003ca href=\"http://browser.check#@vulndetector.com/\"\u003e\u003c/a\u003e\n```\nA comparison of the parsing differences between Jetty and chrome is shown in the table below (note that neither should accept the URI as valid).\n\n| Invalid URI                                       | Jetty            | Chrome        |\n| ---------------------------------------------- | ---------------- | ------------- |\n| http://browser.check \u0026@vulndetector.com/ | vulndetector.com | browser.check |\n| http://browser.check #@vulndetector.com/ | vulndetector.com | browser.check |\n| http://browser.check?@vulndetector.com/    | vulndetector.com | browser.check |\n| http://browser.check#@vulndetector.com/    | vulndetector.com | browser.check |\n\nThe problem of 302 redirect parsing in HTTP 302 Location\n\n| Input                    | Jetty          | Chrome        |\n| ------------------------ | -------------- | ------------- |\n| http://browser.check%5c/ | browser.check\\ | browser.check |\n\nIt is noteworthy that Spring Web also faced similar security vulnerabilities, being affected by the aforementioned four types of payloads. These issues have since been resolved and have been assigned three CVE numbers [3-5].\n\n## Impact\n\nThe impact of this vulnerability is limited to developers that use the Jetty HttpURI directly.  Example: your project implemented a blocklist to block on some hosts based on HttpURI's handling of authority section.  The vulnerability will help attackers bypass the protections that developers have set up for hosts. The vulnerability will lead to **SSRF**[1] and **URL Redirection**[2] vulnerabilities in several cases. \n\n## Mitigation\n\nThe attacks outlined above rely on decoded user data being passed to the `HttpURI` class. Application should not pass decoded user data as an encoded URI to any URI class/method, including `HttpURI`.  Such applications are likely to be vulnerable in other ways. \nThe immediate solution is to upgrade to a version of the class that will fully validate the characters of the URI authority.  Ultimately, Jetty will deprecate and remove support for user info in the authority per [RFC9110 Section 4.2.4](https://datatracker.ietf.org/doc/html/rfc9110#section-4.2.4). \n\nNote that the Chrome (and other browsers) parse the invalid user info section improperly as well (due to flawed WhatWG URL parsing rules that do not apply outside of a Web Browser).\n\n## Reference\n\n[1] https://cwe.mitre.org/data/definitions/918.html\n[2] https://cwe.mitre.org/data/definitions/601.html","status":"published","published":"2024-10-14T21:11:43Z","modified":"2025-03-07T13:49:24Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T14:38:34.185137Z"}],"nvd":[{"id":"CVE-2024-6763","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.","status":"published","published":"2024-10-14T16:15:04.163Z","modified":"2026-06-17T08:18:39.953Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low","assessor":"secondary"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium","assessor":"primary"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T14:10:31.879321Z"}],"osv":[{"id":"CVE-2024-6763","title":"Jetty URI parsing of invalid authority","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after passing validation checks.","status":"published","published":"2024-10-14T15:06:07.298Z","modified":"2026-10-28T02:30:38.43831156Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"DEBIAN-CVE-2024-6763","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.  The HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI  differs from the common browsers in how it handles a URI that would be  considered invalid if fully validated against the RRC.  Specifically HttpURI  and the browser may differ on the value of the host extracted from an  invalid URI and thus a combination of Jetty and a vulnerable browser may  be vulnerable to a open redirect attack or to a SSRF attack if the URI  is used after passing validation checks.","status":"published","published":"2024-10-14T16:15:04.163Z","modified":"2026-11-02T12:03:15.752181426Z","cvss":[{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"GHSA-qh8g-58pp-2wxh","title":"Eclipse Jetty URI parsing of invalid authority","description":"## Summary\n\nEclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, `HttpURI`, for URI/URL parsing.\n\nThe `HttpURI` class does insufficient validation on the authority segment of a URI.  However the behaviour of `HttpURI` differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC.  Specifically `HttpURI` and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.\n\n## Details\n\n### Affected components\n\nThe vulnerable component is the `HttpURI` class when used as a utility class in an application.  The Jetty usage of the class is not vulnerable.\n\n### Attack overview\n\nThe `HttpURI` class does not well validate the authority section of a URI. When presented with an illegal authority that may contain user info (eg username:password#@hostname:port), then the parsing of the URI is not failed.  Moreover, the interpretation of what part of the authority is the host name differs from a common browser in  that they also do not fail, but they select a different host name from the illegal URI.\n\n### Attack scenario\n\nA typical attack scenario is illustrated in the diagram below. The Validator checks whether the attacker-supplied URL is on the blocklist. If not, the URI is passed to the Requester for redirection. The Requester is responsible for sending requests to the hostname specified by the URI.\n\nThis attack occurs when the Validator is the `org.eclipse.jetty.http.HttpURI` class and the Requester is the `Browser` (include chrome, firefox and Safari). An attacker can send a malformed URI to the Validator (e.g., `http://browser.check%23%40vulndetector.com/` ). After validation, the Validator finds that the hostname is not on the blocklist. However, the Requester can still send requests to the domain with the hostname `vulndetector.com`.\n\n## PoC\n\npayloads:\n\n```\nhttp://browser.check \u0026@vulndetector.com/\nhttp://browser.check #@vulndetector.com/\nhttp://browser.check?@vulndetector.com/\nhttp://browser.check#@vulndetector.com/\nhttp://vulndetector.com\\\\/\n```\n\nThe problem of 302 redirect parsing in HTML tag scenarios. Below is a poc example. After clicking the button, the browser will open \"browser.check\", and jetty will parse this URL as \"vulndetector.com\".\n\n```\n\u003ca href=\"http://browser.check#@vulndetector.com/\"\u003e\u003c/a\u003e\n```\nA comparison of the parsing differences between Jetty and chrome is shown in the table below (note that neither should accept the URI as valid).\n\n| Invalid URI                                       | Jetty            | Chrome        |\n| ---------------------------------------------- | ---------------- | ------------- |\n| http://browser.check \u0026@vulndetector.com/ | vulndetector.com | browser.check |\n| http://browser.check #@vulndetector.com/ | vulndetector.com | browser.check |\n| http://browser.check?@vulndetector.com/    | vulndetector.com | browser.check |\n| http://browser.check#@vulndetector.com/    | vulndetector.com | browser.check |\n\nThe problem of 302 redirect parsing in HTTP 302 Location\n\n| Input                    | Jetty          | Chrome        |\n| ------------------------ | -------------- | ------------- |\n| http://browser.check%5c/ | browser.check\\ | browser.check |\n\nIt is noteworthy that Spring Web also faced similar security vulnerabilities, being affected by the aforementioned four types of payloads. These issues have since been resolved and have been assigned three CVE numbers [3-5].\n\n## Impact\n\nThe impact of this vulnerability is limited to developers that use the Jetty HttpURI directly.  Example: your project implemented a blocklist to block on some hosts based on HttpURI's handling of authority section.  The vulnerability will help attackers bypass the protections that developers have set up for hosts. The vulnerability will lead to **SSRF**[1] and **URL Redirection**[2] vulnerabilities in several cases. \n\n## Mitigation\n\nThe attacks outlined above rely on decoded user data being passed to the `HttpURI` class. Application should not pass decoded user data as an encoded URI to any URI class/method, including `HttpURI`.  Such applications are likely to be vulnerable in other ways. \nThe immediate solution is to upgrade to a version of the class that will fully validate the characters of the URI authority.  Ultimately, Jetty will deprecate and remove support for user info in the authority per [RFC9110 Section 4.2.4](https://datatracker.ietf.org/doc/html/rfc9110#section-4.2.4). \n\nNote that the Chrome (and other browsers) parse the invalid user info section improperly as well (due to flawed WhatWG URL parsing rules that do not apply outside of a Web Browser).\n\n## Reference\n\n[1] https://cwe.mitre.org/data/definitions/918.html\n[2] https://cwe.mitre.org/data/definitions/601.html","status":"published","published":"2024-10-14T21:11:43Z","modified":"2026-09-10T03:50:19.940231683Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"4.0","score":6.3,"vector":"CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N","level":"medium"}],"cwes":["CWE-1286"],"updated_at":"2026-11-02T15:46:54.40888Z"},{"id":"ROOT-APP-MAVEN-CVE-2024-6763","title":"CVE-2024-6763 in org.eclipse.jetty:jetty-http - Patched by Root","description":"Root has patched CVE-2024-6763 in the org.eclipse.jetty:jetty-http package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-11-03T08:19:22Z","modified":"2026-11-03T09:15:05.062985182Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"}],"updated_at":"2026-11-03T09:26:33.868904Z"},{"id":"UBUNTU-CVE-2024-6763","description":"Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI  differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC.  Specifically HttpURI  and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may  be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.","status":"published","published":"2024-10-14T16:15:00Z","modified":"2025-10-24T05:06:45Z","cvss":[{"version":"3.1","score":3.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"low"},{"version":"3.1","score":5.3,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"CLSA-2026-1776040415","title":"TuxCare security update for org.eclipse.jetty (4 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 4 CVEs. Fixed in 9.4.53.v20231009-tuxcare.3.","status":"published","published":"2026-08-04T14:52:24Z","modified":"2026-11-02T19:45:23.919886756Z","updated_at":"2026-11-02T20:30:40.499236Z"},{"id":"CLSA-2026-1779238058","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 11.0.26-tuxcare.1.","status":"published","published":"2026-08-04T14:52:33Z","modified":"2026-11-02T19:45:32.145834192Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1788878815","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.50.v20221201-tuxcare.5.","status":"published","published":"2026-09-08T14:46:55Z","modified":"2026-11-02T19:46:14.347445025Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1790803421","title":"TuxCare security update for org.eclipse.jetty:jetty-http (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-http to address 1 CVE. Fixed in 9.4.48.v20220622-tuxcare.5.","status":"published","published":"2026-09-30T21:23:41Z","modified":"2026-11-02T19:46:24.694073078Z","updated_at":"2026-11-02T20:29:22.637147Z"},{"id":"CLSA-2026-1793770980","title":"TuxCare security update for org.eclipse.jetty:jetty-http (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-http to address 1 CVE. Fixed in 9.4.41.v20210516-tuxcare.5.","status":"published","published":"2026-11-04T06:43:01Z","modified":"2026-11-04T14:45:04.952488736Z","updated_at":"2026-11-04T15:03:54.132276Z"},{"id":"openSUSE-SU-2025:15160-1","title":"jetty-annotations-9.4.57-1.1 on GA media","description":"These are all security issues fixed in the jetty-annotations-9.4.57-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-26T00:00:00Z","modified":"2026-03-23T04:53:25.502049Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2025:01738-1","title":"Security update for jetty-minimal","description":"This update for jetty-minimal fixes the following issues:\n\nUpgrade to version 9.4.57.v20241219\n\n- CVE-2024-6763: the HttpURI class does insufficient validation on the authority segment of a URI (bsc#1231652)\n- CVE-2024-13009: Gzip Request Body Buffer (bsc#1243271)\n","status":"published","published":"2025-05-29T09:37:57Z","modified":"2026-03-23T04:48:29.05214Z","updated_at":"2026-11-02T15:53:56.123059Z"}]}}