Eclipse Foundation Jetty vulnerabilities

• eclipse foundation jetty When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may... CVE-2026-77711 Fix available 8.2 HighSeptember 24, 2026
• eclipse foundation jetty In Eclipse Jetty, HttpClient may receive a redirect of the form: ``` /secure/../evil ```... CVE-2026-76184 Fix available 8.2 HighSeptember 24, 2026
• eclipse foundation jetty In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to... CVE-2026-76182 Fix available 6.9 MediumSeptember 24, 2026
• eclipse foundation jetty A client may send a WebSocket frame with an unknown opcode and a very large declared payload... CVE-2026-19204 Fix available 8.7 HighAugust 28, 2026
• eclipse foundation jetty A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty... CVE-2026-19203 Fix available 8.3 HighAugust 27, 2026
• eclipse foundation jetty A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are... CVE-2026-12611 Fix available 8.7 HighAugust 27, 2026
• eclipse jetty, eclipse foundation jetty - ee8, jetty - ee9 +2 more Digest authentication lossy encoding CVE-2026-10050 Fix available 8.7 HighJuly 22, 2026
• eclipse jetty Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests CVE-2024-7708 Fix available 7.5 HighJuly 14, 2026
• eclipse jetty Eclipse Jetty: Path parameter traversal CVE-2026-8384 Fix available 5.3 MediumJuly 14, 2026
• eclipse jetty Eclipse Jetty: HTTP Authority/Host mismatch CVE-2026-6790 Fix available 5.3 MediumJuly 14, 2026
• eclipse jetty Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections CVE-2026-10051 Fix available 6.9 MediumJuly 14, 2026
• eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +39 more +41 more HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVE-2026-2332 Public exploitFix available 7.4 HighApril 14, 2026
• eclipse jetty, red hat hawtio hawtio 4.4.0, build of apache camel 4.18.1 for spring boot 3.5.14 +6 more +8 more Duplicate Advisory: Eclipse Jetty: Early return from the JASPIAuthenticator code can potentially no clear ThreadLocal variables CVE-2026-5795 Fix available 7.4 HighApril 8, 2026
• eclipse jetty, red hat hawtio hawtio 4.4.0, openshift developer tools and services +35 more +37 more The Eclipse Jetty Server Artifact has a Gzip request memory leak CVE-2026-1605 Fix available 7.5 HighMarch 5, 2026
• eclipse jetty Eclipse Jetty HTTP clients can increase memory allocation CVE-2025-1948 Fix available 7.5 HighMay 8, 2025
• eclipse jetty Jetty URI parsing of invalid authority CVE-2024-6763 Fix available 3.7 LowOctober 14, 2024
• eclipse jetty MadeYouReset HTTP/2 vulnerability CVE-2025-5115 Fix available 7.7 HighJuly 10, 2023
• eclipse jetty Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2025-11143 Fix available 3.7 LowJuly 10, 2023
• eclipse jetty, netapp active iq unified manager, bootstrap os +2 more Jetty DOS vulnerability on DosFilter CVE-2024-9823 Fix available 5.3 MediumJuly 10, 2023
• eclipse jetty Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks CVE-2024-8184 Fix available 5.9 MediumJuly 10, 2023
• eclipse jetty Jetty PushSessionCacheFilter can cause remote DoS attacks CVE-2024-6762 Fix available 3.1 LowJuly 10, 2023
• eclipse jetty Eclipse Jetty GZIP buffer release CVE-2024-13009 Fix available 7.2 HighJuly 10, 2023
• eclipse jetty, the eclipse foundation eclipse jetty +1 more Jetty SslConnection does not release pooled ByteBuffers in case of errors CVE-2022-2191 Fix available 7.5 HighJuly 7, 2022
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +5 more +7 more Jetty invalid URI parsing may produce invalid HttpURI.authority CVE-2022-2047 Fix available 2.7 LowJuly 7, 2022
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +6 more +8 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2022-2048 Fix available 7.5 HighJuly 7, 2022
• eclipse jetty, the eclipse foundation eclipse jetty, netapp e-series santricity os controller +16 more +18 more Encoded URIs can access WEB-INF directory in Eclipse Jetty CVE-2021-34429 Public exploitFix available EPSS 99.3% 5.3 MediumJuly 15, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +14 more +16 more SessionListener can prevent a session from being invalidated breaking logout CVE-2021-34428 Public exploitFix available 2.9 LowJune 22, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +6 more +8 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2021-28169 Fix available EPSS 78.5% 5.3 MediumJune 9, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, jenkins +19 more +21 more Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources CVE-2021-28165 Public exploitFix available EPSS 53.9% 7.5 HighApril 1, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, netapp cloud manager +15 more +17 more Authorization Before Parsing and Canonicalization in jetty CVE-2021-28164 Public exploitFix available EPSS 82.4% 5.3 MediumApril 1, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, apache ignite +21 more +23 more Directory exposure in jetty CVE-2021-28163 Fix available 2.7 LowApril 1, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, apache nifi +14 more +16 more DOS vulnerability for Quoted Quality CSV headers CVE-2020-27223 Public exploitFix available EPSS 78.0% 5.2 MediumFebruary 26, 2021
• eclipse jetty, the eclipse foundation eclipse jetty, apache kafka +15 more +17 more Buffer not correctly recycled in Gzip Request inflation CVE-2020-27218 Fix available 4.8 MediumNovember 28, 2020
• eclipse jetty, the eclipse foundation eclipse jetty, apache beam +16 more +18 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2020-27216 Fix available 7.0 HighOctober 23, 2020
• eclipse jetty, the eclipse foundation eclipse jetty +1 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2019-17638 Public exploitFix available EPSS 11.1% 9.4 CriticalJuly 9, 2020
• eclipse jetty, the eclipse foundation eclipse jetty +1 more Unescaped exception messages in error responses in Jetty CVE-2019-17632 Fix available 6.1 MediumNovember 25, 2019
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +24 more +26 more Installation information leak in Eclipse Jetty CVE-2019-10247 Fix available 5.3 MediumApril 22, 2019
• eclipse jetty, the eclipse foundation eclipse jetty, netapp element +23 more +25 more Information Exposure vulnerability in Eclipse Jetty CVE-2019-10246 Fix available 5.3 MediumApril 22, 2019
• eclipse jetty, the eclipse foundation eclipse jetty, apache activemq +5 more +7 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2019-10241 Fix available 6.1 MediumApril 22, 2019
• eclipse jetty, the eclipse foundation eclipse jetty, fedoraproject fedora +2 more Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server CVE-2018-12545 Fix available 7.5 HighMarch 27, 2019
• eclipse jetty, the eclipse foundation eclipse jetty, oracle retail xstore point of service +2 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2018-12536 Fix available 5.3 MediumJune 27, 2018
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +17 more +19 more Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling) CVE-2017-7658 Fix available EPSS 19.0% 9.8 CriticalJune 26, 2018
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +15 more +17 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2017-7657 Fix available EPSS 14.4% 9.8 CriticalJune 26, 2018
• eclipse jetty, the eclipse foundation eclipse jetty, debian linux +2 more Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations CVE-2017-7656 Fix available 7.5 HighJune 26, 2018
• eclipse jetty, the eclipse foundation eclipse jetty, netapp e-series santricity management plug-ins +10 more +12 more Access and integrity issue within Eclipse Jetty CVE-2018-12538 Fix available 8.8 HighJune 22, 2018