The Eclipse Foundation Eclipse Jetty
23 published vulnerabilities name this product.
As the CNAs write it in their CVE records (vendor and product); the versions are theirs.
| CVE | Vulnerable versions | Title | Severity | Published | EPSS | Exploitation |
|---|---|---|---|---|---|---|
| CVE-2022-2191 | 10.0.0 – < unspecified ; unspecified – 10.0.9 ; 11.0.0 – < unspecified ; … | In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured By | HIGH 7.5 | 2.2 % | ||
| CVE-2022-2047 | 9.4.0 – < unspecified ; unspecified – 9.4.46 ; 10.0.0 – < unspecified ; … | In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment o | LOW 2.7 | 1.3 % | ||
| CVE-2022-2048 | 9.4.0 – < unspecified ; unspecified – 9.4.46 ; 10.0.0 – < unspecified ; … | In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up no | HIGH 7.5 | 2.6 % | ||
| CVE-2021-34429 | 9.4.37 – < unspecified ; unspecified – 9.4.42 ; 10.0.1 – < unspecified ; … | For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the con | MEDIUM 5.3 | 99 % | ||
| CVE-2021-34428 | 9.0.0 – < unspecified ; unspecified – 9.4.40 ; 10.0.0 – < unspecified ; … | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, th | LOW 3.5 | 1.0 % | ||
| CVE-2021-28169 | unspecified – 9.4.40 ; unspecified – 10.0.2 ; unspecified – 11.0.2 | For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to a | MEDIUM 5.3 | 78 % | ||
| CVE-2021-28165 | 7.2.2 – < unspecified ; unspecified – 9.4.38 ; 10.0.0.alpha0 – < unspecified ; … | In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large inva | HIGH 7.5 | 54 % | ||
| CVE-2021-28164 | 9.4.37.v20210219 – < unspecified ; unspecified – 9.4.38.v20210224 | In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segm | MEDIUM 5.3 | 82 % | ||
| CVE-2021-28163 | 9.4.32 – < unspecified ; unspecified – 9.4.38 ; 10.0.0.beta2 – < unspecified ; … | In Eclipse Jetty 9.4.32 to 9.4.38, 10.0.0.beta2 to 10.0.1, and 11.0.0.beta2 to 11.0.1, if a user uses a webapps directory that is a symlink, | LOW 2.7 | 4.2 % | ||
| CVE-2020-27223 | 9.4.6.v20170531 – < unspecified ; unspecified – 9.4.36.v20210114 ; 10.0.0 ; … | In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept | MEDIUM 5.3 | 78 % | ||
| CVE-2020-27218 | 9.4.0.RC0 to 9.4.34.v20201102 ; 10.0.0.alpha0 to 10.0.0.beta2 ; 11.0.0.alpha0 to 11.0.0.beta2 | In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request bo | MEDIUM 4.8 | 8.3 % | ||
| CVE-2020-27216 | 1.0 to 9.4.32.v20200930 ; 10.0.0.alpha1 to 10.0.0.beta2 ; 11.0.0.alpha1 to 11.0.0.beta2 | In Eclipse Jetty versions 1.0 thru 9.4.32.v20200930, 10.0.0.alpha1 thru 10.0.0.beta2, and 11.0.0.alpha1 thru 11.0.0.beta2O, on Unix like sys | HIGH 7.0 | 4.4 % | ||
| CVE-2019-17638 | 9.4.27.v20200227 to 9.4.29.v20200521 | In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce | CRITICAL 9.4 | 11 % | ||
| CVE-2019-17632 | 9.4.21.v20190926 ; 9.4.22.v20191022 ; 9.4.23.v20191118 | In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response conte | MEDIUM 6.1 | 1.9 % | ||
| CVE-2019-10247 | 7.x ; 8.x ; unspecified – 9.2.27 ; … | In Eclipse Jetty version 7.x, 8.x, 9.2.27 and older, 9.3.26 and older, and 9.4.16 and older, the server running on any OS and Jetty version | MEDIUM 5.3 | 5.9 % | ||
| CVE-2019-10246 | 9.2.27 ; 9.3.26 ; 9.4.16 | In Eclipse Jetty version 9.2.27, 9.3.26, and 9.4.16, the server running on Windows is vulnerable to exposure of the fully qualified Base Res | MEDIUM 5.3 | 4.1 % | ||
| CVE-2019-10241 | unspecified – 9.2.26 ; unspecified – 9.3.25 ; unspecified – 9.4.15 | In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote cl | MEDIUM 6.1 | 9.4 % | ||
| CVE-2018-12545 | 9.3.0 – < unspecified ; unspecified – < 9.4.12 | In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SET | HIGH 7.5 | 5.1 % | ||
| CVE-2018-12536 | unspecified – 9.2.0 ; 9.3.0 – < unspecified ; unspecified – < 9.3.24 ; … | In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that do | MEDIUM 5.3 | 4.4 % | ||
| CVE-2017-7658 | unspecified – < 9.2.25 ; 9.3.0 – < unspecified ; unspecified – < 9.3.24 ; … | In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when pr | CRITICAL 9.8 | 19 % | ||
| CVE-2017-7657 | unspecified – 9.2.0 ; 9.3.0 – < unspecified ; unspecified – < 9.3.24 ; … | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled | CRITICAL 9.8 | 15 % | ||
| CVE-2017-7656 | unspecified – 9.2.0 ; 9.3.0 – < unspecified ; unspecified – < 9.3.24 ; … | In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled | HIGH 7.5 | 6.3 % | ||
| CVE-2018-12538 | unspecified – < 9.4.9 ; 9.4.0 – < unspecified | In Eclipse Jetty versions 9.4.0 through 9.4.8, when using the optional Jetty provided FileSessionDataStore for persistent storage of HttpSes | HIGH 8.8 | 2.7 % |