Search for packages
| purl | pkg:maven/org.eclipse.jetty/jetty-server@9.0.0 |
| Tags | Ghost |
| Next non-vulnerable version | 9.4.57.v20241219 |
| Latest non-vulnerable version | 12.1.6 |
| Risk | 3.1 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-q3k2-1x5q-buhy
Aliases: CVE-2023-40167 GHSA-hmr7-m48g-48f6 |
Improper Handling of Length Parameter Inconsistency Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario. |
Affected by 1 other vulnerability. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. Affected by 0 other vulnerabilities. |
|
VCID-u2b5-uyd6-fbh9
Aliases: CVE-2018-12536 GHSA-9rgv-h7x4-qw8g |
In Eclipse Jetty Server, all 9.x versions, on webapps deployed using default Error Handling, when an intentionally bad query arrives that doesn't match a dynamic url-pattern, and is eventually handled by the DefaultServlet's static file serving, the bad characters can trigger a java.nio.file.InvalidPathException which includes the full path to the base resource directory that the DefaultServlet and/or webapp is using. If this InvalidPathException is then handled by the default Error Handler, the InvalidPathException message is included in the error response, revealing the full server path to the requesting system. |
Affected by 9 other vulnerabilities. Affected by 9 other vulnerabilities. Affected by 11 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2026-04-01T15:57:02.926028+00:00 | GHSA Importer | Affected by | VCID-u2b5-uyd6-fbh9 | https://github.com/advisories/GHSA-9rgv-h7x4-qw8g | 38.0.0 |
| 2026-04-01T12:51:49.829350+00:00 | GitLab Importer | Affected by | VCID-q3k2-1x5q-buhy | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty/jetty-server/CVE-2023-40167.yml | 38.0.0 |
| 2026-04-01T12:47:48.958844+00:00 | GitLab Importer | Affected by | VCID-u2b5-uyd6-fbh9 | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty/jetty-server/CVE-2018-12536.yml | 38.0.0 |