CVE-2011-4461 Improper Input Validation in Jetty

MediumCVSS 5.3 EPSS 4.9%

Published: 2011-12-30 03:00
Updated: 2026-06-17 02:34
Exploit status: No public exploit known

Description

Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to trigger hash collisions predictably, which allows remote attackers to cause a denial of service (CPU consumption) by sending many crafted parameters.

Affected products

Product	Affected versions	Fixed in
org.eclipse.jetty/jetty-server(Maven)	< 8.1.0.RC4	8.1.0.RC4
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.M0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.M1	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.M2	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.M3	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.M4	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.RC0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.RC1	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.RC2	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.RC3	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.RC4	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.RC5	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.RC6	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.0.v20091005	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.1.v20091125	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.2.RC0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.0.2.v20100331	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.1.0.RC0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.1.0.RC1	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.1.0.v20100505	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.1.1.v20100517	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.1.2.v20100523	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.1.3.v20100526	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.1.4.v20100610	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.1.5.v20100705	No fix listed

Show 175 more

Product	Affected versions	Fixed in
org.eclipse.jetty/jetty-server(Maven)	= 7.1.6.v20100715	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.2.0.RC0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.2.0.v20101020	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.2.1.v20101111	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.2.2.v20101205	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.3.0.v20110203	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.3.1.v20110307	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.4.0.RC0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.4.0.v20110414	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.4.1.v20110513	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.4.2.v20110526	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.4.3.v20110701	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.4.4.v20110707	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.4.5.v20110725	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.5.0.RC0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.5.0.RC1	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.5.0.RC2	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.5.0.v20110901	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.5.1.v20110908	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.5.2.v20111006	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.5.3.v20111011	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.5.4.v20111024	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.0.RC0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.0.RC1	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.0.RC2	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.0.RC3	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.0.RC4	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.0.RC5	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.0.v20120127	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.1.v20120215	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.10.v20130312	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.11.v20130520	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.12.v20130726	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.13.v20130916	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.14.v20131031	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.15.v20140411	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.16.v20140903	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.17.v20150415	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.18.v20150929	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.19.v20160209	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.2.v20120308	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.20.v20160902	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.21.v20160908	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.3.v20120416	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.4.v20120524	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.5.v20120716	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.6.v20120903	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.7.v20120910	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.8.v20121106	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 7.6.9.v20130131	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.0.M0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.0.M1	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.0.M2	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.0.M3	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.0.RC0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.0.v20110901	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.1.v20110908	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.2.v20111006	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.3.v20111011	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.0.4.v20111024	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.1.0.RC0	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.1.0.RC1	No fix listed
org.eclipse.jetty/jetty-server(Maven)	= 8.1.0.RC2	No fix listed
org.eclipse.jetty/jetty-server(Maven)	<= 8.1.0.RC2	No fix listed
oracle sun storage common array manager	= 6.9.0	No fix listed
mortbay jetty	<= 8.1.0	No fix listed
mortbay jetty	= 1.0	No fix listed
mortbay jetty	= 1.0.1	No fix listed
mortbay jetty	= 1.1	No fix listed
mortbay jetty	= 1.1.1	No fix listed
mortbay jetty	= 1.2.0	No fix listed
mortbay jetty	= 1.3.0	No fix listed
mortbay jetty	= 1.3.1	No fix listed
mortbay jetty	= 1.3.2	No fix listed
mortbay jetty	= 1.3.3	No fix listed
mortbay jetty	= 1.3.4	No fix listed
mortbay jetty	= 1.3.5	No fix listed
mortbay jetty	= 2.0-alpha1	No fix listed
mortbay jetty	= 2.0-alpha2	No fix listed
mortbay jetty	= 2.0-beta1	No fix listed
mortbay jetty	= 2.0-beta2	No fix listed
mortbay jetty	= 2.0.0	No fix listed
mortbay jetty	= 2.0.1	No fix listed
mortbay jetty	= 2.0.2	No fix listed
mortbay jetty	= 2.0.3	No fix listed
mortbay jetty	= 2.0.4	No fix listed
mortbay jetty	= 2.0.5	No fix listed
mortbay jetty	= 2.1.0	No fix listed
mortbay jetty	= 2.1.1	No fix listed
mortbay jetty	= 2.1.2	No fix listed
mortbay jetty	= 2.1.3	No fix listed
mortbay jetty	= 2.1.4	No fix listed
mortbay jetty	= 2.1.5	No fix listed
mortbay jetty	= 2.1.6	No fix listed
mortbay jetty	= 2.1.7	No fix listed
mortbay jetty	= 2.1.b0	No fix listed
mortbay jetty	= 2.1.b1	No fix listed
mortbay jetty	= 2.2-alpha0	No fix listed
mortbay jetty	= 2.2-alpha1	No fix listed
mortbay jetty	= 2.2-beta0	No fix listed
mortbay jetty	= 2.2-beta1	No fix listed
mortbay jetty	= 2.2-beta2	No fix listed
mortbay jetty	= 2.2-beta3	No fix listed
mortbay jetty	= 2.2-beta4	No fix listed
mortbay jetty	= 2.2.0	No fix listed
mortbay jetty	= 2.2.1	No fix listed
mortbay jetty	= 2.2.2	No fix listed
mortbay jetty	= 2.2.3	No fix listed
mortbay jetty	= 2.2.4	No fix listed
mortbay jetty	= 2.2.5	No fix listed
mortbay jetty	= 2.2.6	No fix listed
mortbay jetty	= 2.2.7	No fix listed
mortbay jetty	= 2.2.8	No fix listed
mortbay jetty	= 2.3.0	No fix listed
mortbay jetty	= 2.3.0a	No fix listed
mortbay jetty	= 2.3.1	No fix listed
mortbay jetty	= 2.3.2	No fix listed
mortbay jetty	= 2.3.3	No fix listed
mortbay jetty	= 2.3.4	No fix listed
mortbay jetty	= 2.3.5	No fix listed
mortbay jetty	= 2.4.0	No fix listed
mortbay jetty	= 2.4.1	No fix listed
mortbay jetty	= 2.4.2	No fix listed
mortbay jetty	= 2.4.3	No fix listed
mortbay jetty	= 2.4.4	No fix listed
mortbay jetty	= 2.4.5	No fix listed
mortbay jetty	= 2.4.6	No fix listed
mortbay jetty	= 2.4.7	No fix listed
mortbay jetty	= 2.4.8	No fix listed
mortbay jetty	= 2.4.9	No fix listed
mortbay jetty	= 3.0	No fix listed
mortbay jetty	= 3.0.0	No fix listed
mortbay jetty	= 3.0.0-rc1	No fix listed
mortbay jetty	= 3.0.0-rc2	No fix listed
mortbay jetty	= 3.0.0-rc3	No fix listed
mortbay jetty	= 3.0.0-rc4	No fix listed
mortbay jetty	= 3.0.0-rc5	No fix listed
mortbay jetty	= 3.0.0-rc6	No fix listed
mortbay jetty	= 3.0.0-rc7	No fix listed
mortbay jetty	= 3.0.0-rc8	No fix listed
mortbay jetty	= 3.0.1	No fix listed
mortbay jetty	= 3.0.2	No fix listed
mortbay jetty	= 3.0.3	No fix listed
mortbay jetty	= 3.0.4	No fix listed
mortbay jetty	= 3.0.5	No fix listed
mortbay jetty	= 3.0.6	No fix listed
mortbay jetty	= 3.0.a0	No fix listed
mortbay jetty	= 3.0.a1	No fix listed
mortbay jetty	= 3.0.a2	No fix listed
mortbay jetty	= 3.0.a3	No fix listed
mortbay jetty	= 3.0.a4	No fix listed
mortbay jetty	= 3.0.a5	No fix listed
mortbay jetty	= 3.0.a6	No fix listed
mortbay jetty	= 3.0.a7	No fix listed
mortbay jetty	= 3.0.a8	No fix listed
mortbay jetty	= 3.0.a9	No fix listed
mortbay jetty	= 3.0.a90	No fix listed
mortbay jetty	= 3.0.a91	No fix listed
mortbay jetty	= 3.0.a92	No fix listed
mortbay jetty	= 3.0.a93	No fix listed
mortbay jetty	= 3.0.a94	No fix listed
mortbay jetty	= 3.0.a95	No fix listed
mortbay jetty	= 3.0.a96	No fix listed
mortbay jetty	= 3.0.a97	No fix listed
mortbay jetty	= 3.0.a98	No fix listed
mortbay jetty	= 3.0.a99	No fix listed
mortbay jetty	= 3.0.b01	No fix listed
mortbay jetty	= 3.0.b02	No fix listed
mortbay jetty	= 3.0.b03	No fix listed
mortbay jetty	= 3.0.b04	No fix listed
mortbay jetty	= 3.0.b05	No fix listed
mortbay jetty	= 3.1-rc0	No fix listed
mortbay jetty	= 3.1-rc1	No fix listed
mortbay jetty	= 3.1-rc2	No fix listed
mortbay jetty	= 3.1-rc3	No fix listed

References

nvd.nist.gov third-party-advisory vendor-advisory
github.com patch
jetty-hash-dos(72017) vdb-entry
github.com product
security.netapp.com
HPSBST03346 vendor-advisory
VU#903934 third-party-advisory us-government-resource
www.ocert.org
www.oracle.com
www.oracle.com
www.oracle.com
USN-1429-1 vendor-advisory
github.com
20111228 n.runs-SA-2011.004 - web programming languages and platforms - DoS through hash table mailing-list
47408 third-party-advisory
48981 third-party-advisory
www.nruns.com
1026475 vdb-entry

CVSS v3.0

5.3 Medium

CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Attack Vector: Network
Attack Complexity: Low
Privileges Required: None
User Interaction: None
Scope: Unchanged
Confidentiality: None
Integrity: None
Availability: Low

All scores (4)

v3.0 5.3 · nvd@nist.gov
v3.0 5.3 · github
v3.0 5.3 · osv:ghsa
v2.0 5.0 · nvd@nist.gov

Weakness & likelihood

EPSS (exploitation probability, 30 days): 4.92% (percentile 92.3)
CWE: CWE-20 Improper Input Validation CWE-310

Public exploit references

Metadata only. CVERadar never hosts or runs exploit code.

No public exploit references known.