{"id":"CVE-2024-7708","aliases":["CLSA-2026-1785292544","CLSA-2026-1794247837","DEBIAN-CVE-2024-7708","EUVD-2024-55651","GHSA-9299-c6m4-mjhc","UBUNTU-CVE-2024-7708"],"status":"published","title":"Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests","description":"For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.0044,"percentile":0.38551,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-401"],"published":"2026-07-14T09:01:53Z","modified":"2026-11-10T01:15:02Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["10.0.23","11.0.23"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["11.0.19-tuxcare.3"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.7"},{"fixed":"10.0.23"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.7"},{"fixed":"11.0.23"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.3"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.2"}]}],"versions":["11.0.18","11.0.18-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.2"}]}],"versions":["11.0.18","11.0.18-tuxcare.1"],"bundled":2},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1","9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.7"},{"fixed":"10.0.23"}]}],"versions":["10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.20","10.0.21","10.0.22","10.0.7","10.0.8","10.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.7"},{"fixed":"11.0.23"}]}],"versions":["11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.20","11.0.21","11.0.22","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3.1","12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"}],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29","tags":["Issue Tracking","Vendor Advisory","web","report"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-9299-c6m4-mjhc","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7708","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project/pull/12156","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/commit/8259eabbc70ae7fc2d525f1e95b43fbdfd2ad097","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.23","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.23","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9299-c6m4-mjhc"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/7xxx/CVE-2024-7708.json","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-7708","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-7708","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-7708","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2024-7708","description":"For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.","status":"published","published":"2026-07-14T09:01:53.869Z","modified":"2026-07-14T12:17:11.635Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T14:34:21.025267Z"}],"euvd":[{"id":"EUVD-2024-55651","description":"For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.","status":"published","published":"2026-07-14T09:01:53Z","modified":"2026-07-14T12:17:11Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T18:20:00.696533Z"}],"ghsa":[{"id":"GHSA-9299-c6m4-mjhc","title":"Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests","description":"### Impact\nThe original report:\n\n\u003e Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.\n\nAfter investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.\n\n### Affected Versions\n\n* Jetty 11.0.0-11.0.22 (EOL)\n* Jetty 10.0.0-10.0.22 (EOL)\n\n### Patched Versions\n\n* Jetty 11.0.23\n* Jetty 10.0.23\n\n### Patches\n\nhttps://github.com/jetty/jetty.project/pull/12156\n\n### Workarounds\n\nNo workarounds.","status":"published","published":"2026-07-22T22:58:29Z","modified":"2026-07-22T22:58:31Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T14:40:51.375752Z"}],"nvd":[{"id":"CVE-2024-7708","description":"For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.","status":"published","published":"2026-07-14T09:16:39.453Z","modified":"2026-10-02T00:10:00.18Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T14:10:47.77313Z"}],"osv":[{"id":"CVE-2024-7708","description":"For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.","status":"published","published":"2026-07-14T09:01:53.869Z","modified":"2026-10-28T02:30:28.601937293Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T15:44:45.405014Z"},{"id":"DEBIAN-CVE-2024-7708","description":"For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.","status":"published","published":"2026-07-14T09:16:39.453Z","modified":"2026-09-15T09:02:55.894334041Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:44.747956Z"},{"id":"GHSA-9299-c6m4-mjhc","title":"Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests","description":"### Impact\nThe original report:\n\n\u003e Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.\n\nAfter investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.\n\n### Affected Versions\n\n* Jetty 11.0.0-11.0.22 (EOL)\n* Jetty 10.0.0-10.0.22 (EOL)\n\n### Patched Versions\n\n* Jetty 11.0.23\n* Jetty 10.0.23\n\n### Patches\n\nhttps://github.com/jetty/jetty.project/pull/12156\n\n### Workarounds\n\nNo workarounds.","status":"published","published":"2026-07-22T22:58:29Z","modified":"2026-07-22T23:26:43.230686Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T15:46:43.123867Z"},{"id":"UBUNTU-CVE-2024-7708","description":"For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.","status":"published","published":"2026-07-14T09:16:00Z","modified":"2026-10-17T12:56:59.975983123Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:18.664792Z"},{"id":"CLSA-2026-1785292544","title":"TuxCare security update for org.eclipse.jetty:jetty-server (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty:jetty-server to address 1 CVE. Fixed in 11.0.19-tuxcare.3.","status":"published","published":"2026-08-04T14:52:50Z","modified":"2026-11-02T19:45:47.913540612Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1794247837","title":"TuxCare security update for org.eclipse.jetty (2 CVEs)","description":"TuxCare rebuilt 2 org.eclipse.jetty packages to address 2 CVEs. Fixed in 11.0.18-tuxcare.2.","status":"published","published":"2026-11-09T19:10:38Z","modified":"2026-11-10T01:15:02.469925972Z","updated_at":"2026-11-10T01:43:20.132342Z"}]}}