org.eclipse.jetty/jetty-servlets vulnerabilities

Latest org.eclipse.jetty/jetty-servlets CVEs

Newest publication first

1. CVE-2024-6762 Jetty PushSessionCacheFilter can cause remote DoS attacks

   Published 2024-10-14

   Medium·CVSS 6.5 EPSS 0.94%

   Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.

2. CVE-2024-9823 Jetty DOS vulnerability on DosFilter

   Published 2024-10-14

   High·CVSS 7.5 EPSS 0.94%

   There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the s...

3. CVE-2023-36479 Jetty vulnerable to errant command quoting in CGI Servlet

   Published 2023-09-15

   Low·CVSS 3.1 EPSS 1.2%

   Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a spac...

4. CVE-2021-28169 Jetty Utility Servlets ConcatServlet Double Decoding Information Disclosure Vulnerability

   Published 2021-06-09

   Medium·CVSS 5.3 EPSS 78.5%

   For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, it is possible for requests to the ConcatServlet with a doubly encoded path to access protected resources within the WEB-INF directory. For example a request to /concat?/%2557EB-INF/web.xml can retrieve the web.xml file....

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.