Alta

UNSUPPORTED WHEN ASSIGNED GzipHandler causes part of request body to be seen as request body of a separate request

Publicada: 08.05.2025
Actualizado: 11.10.2026 13:20

In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

Plataforma	Paquete	Versiones vulnerables	Corregida en
Java / Kotlin (Maven)	org.eclipse.jetty:jetty-server	>= 9.4.0, < 9.4.57.v20241219	9.4.57.v20241219

Referencias

Puntuación CVSS 7.2/10

Vector CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Debilidad (CWE): CWE-404
Plataforma: Java / Kotlin (Maven)
Paquete: org.eclipse.jetty:jetty-server
Publicada: 08.05.2025
Actualizado: 11.10.2026 13:20

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-q4rv-gq96-w7c5 - CC BY 4.0

Historial de vulnerabilidades: org.eclipse.jetty:jetty-server

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (29) en el archivo

Entradas en total: 29
Primera → última: 10.2018 07.2026
Sin corrección: 0
Explotada en ataques: 0

Distribución por gravedad

Crítica 4
Alta 10
Media 13
Baja 2

Divulgaciones por año

2018: 8
2019: 5
2020: 2
2021: 3
2022: 3
2023: 2
2024: 1
2025: 1
2026: 4

22.07.2026

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Alta · 7.5 CVE-2024-7708 >= 10.0.7, < 10.0.23, >= 11.0.7, < 11.0.23 10.0.23, 11.0.23
05.03.2026

The Eclipse Jetty Server Artifact has a Gzip request memory leak

Alta · 7.5 CVE-2026-1605 >= 12.1.0, < 12.1.6, >= 12.0.0, < 12.0.32 12.1.6, 12.0.32
08.05.2025

**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request esta entrada

Alta · 7.2 CVE-2024-13009 >= 9.4.0, < 9.4.57.v20241219 9.4.57.v20241219
07.07.2022

Jetty SslConnection does not release pooled ByteBuffers in case of errors

Alta · 7.5 CVE-2022-2191 >= 10.0.0, < 10.0.10, >= 11.0.0, < 11.0.10 10.0.10, 11.0.10
06.04.2021

Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

Alta · 7.5 CVE-2021-28165 >= 7.2.2, < 9.4.39, >= 10.0.0, < 10.0.2, >= 11.0.0, < 11.0.2 9.4.39, 10.0.2, 11.0.2
05.08.2020

Operation on a Resource after Expiration or Release in Jetty Server

Crítica · 9.4 CVE-2019-17638 >= 9.4.27, < 9.4.30.v20200611 9.4.30.v20200611
28.03.2019

Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

Alta · 7.5 CVE-2018-12545 >= 9.4.0, < 9.4.12.v20180830, >= 9.3.0, < 9.3.25.v20180904 9.4.12.v20180830, 9.3.25.v20180904
09.11.2018

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

Alta · 7.5 CVE-2015-2080 < 9.2.9.v20150224 9.2.9.v20150224
19.10.2018

Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

Crítica · 9.8 CVE-2017-7658 < 9.2.25.v20180606, >= 9.3.0, < 9.3.24.v20180605, >= 9.4.0, < 9.4.11.v20180605 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605
19.10.2018

Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)

Alta · 7.5 CVE-2017-7656 < 9.3.24.v20180605, >= 9.4.0, < 9.4.11.v20180605 9.3.24.v20180605, 9.4.11.v20180605
19.10.2018

Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

Crítica · 9.8 CVE-2016-4800 >= 9.3.0, < 9.3.9 9.3.9
19.10.2018

Jetty vulnerable to exposure of sensitive information due to observable discrepancy

Alta · 7.5 CVE-2017-9735 >= 9.4.0, < 9.4.6.v20170531, >= 9.3.0, < 9.3.20.v20170531, < 9.2.22.v20170606 9.4.6.v20170531, 9.3.20.v20170531, 9.2.22.v20170606
19.10.2018

Critical severity vulnerability that affects org.eclipse.jetty:jetty-server

Crítica · 9.8 CVE-2017-7657 < 9.2.25.v20180606, >= 9.3.0, < 9.3.24.v20180605 9.2.25.v20180606, 9.3.24.v20180605
16.10.2018

Access and integrity issue within Eclipse Jetty

Alta · 8.8 CVE-2018-12538 >= 9.4.0, < 9.4.11.v20180605 9.4.11.v20180605

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación