Search for packages
| purl | pkg:maven/org.eclipse.jetty/jetty-http@10.0.14 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-1pjh-3upb-aaaq
Aliases: CVE-2023-36478 GHSA-wgh7-54f2-x98r |
HTTP/2 HPACK integer overflow and buffer allocation |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-87rw-weuq-aaaq
Aliases: CVE-2023-40167 GHSA-hmr7-m48g-48f6 |
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario. |
Affected by 1 other vulnerability. Affected by 1 other vulnerability. Affected by 1 other vulnerability. |
|
VCID-bnhg-w29f-ufeb
Aliases: CVE-2024-6763 GHSA-qh8g-58pp-2wxh |
Eclipse Jetty URI parsing of invalid authority |
Affected by 0 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| VCID-4pm7-acja-aaar | Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies |
CVE-2023-26049
GHSA-p26g-97m4-6q7c |
| VCID-vz7f-5qd7-aaar | OutOfMemoryError for large multipart without filename in Eclipse Jetty |
CVE-2023-26048
GHSA-qw69-rqj8-6qw8 |