Search for packages
| purl | pkg:maven/org.eclipse.jetty/jetty-server@9.2.26 |
| Tags | Ghost |
| Next non-vulnerable version | 9.4.57.v20241219 |
| Latest non-vulnerable version | 12.0.9 |
| Risk | 4.5 |
| Vulnerability | Summary | Fixed by |
|---|---|---|
|
VCID-7zyh-qpe9-4qas
Aliases: CVE-2019-10241 GHSA-7vx9-xjhr-rw6h |
Cross-site Scripting in Eclipse Jetty In Eclipse Jetty version 9.2.26 and older, 9.3.25 and older, and 9.4.15 and older, the server is vulnerable to XSS conditions if a remote client USES a specially formatted URL against the DefaultServlet or ResourceHandler that is configured for showing a Listing of directory contents. |
Affected by 10 other vulnerabilities. Affected by 9 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 8 other vulnerabilities. Affected by 11 other vulnerabilities. Affected by 11 other vulnerabilities. |
|
VCID-qquy-s15h-d7bd
Aliases: CVE-2017-7656 GHSA-84q7-p226-4x5w |
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response. |
Affected by 10 other vulnerabilities. Affected by 9 other vulnerabilities. Affected by 12 other vulnerabilities. |
|
VCID-uakh-waws-87bk
Aliases: CVE-2017-7658 GHSA-6x9x-8qw9-9pp6 |
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization. |
Affected by 10 other vulnerabilities. Affected by 9 other vulnerabilities. Affected by 12 other vulnerabilities. |
| Vulnerability | Summary | Aliases |
|---|---|---|
| This package is not known to fix vulnerabilities. | ||
| Date | Actor | Action | Vulnerability | Source | VulnerableCode Version |
|---|---|---|---|---|---|
| 2025-07-01T18:11:35.655651+00:00 | GitLab Importer | Affected by | VCID-7zyh-qpe9-4qas | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty/jetty-server/CVE-2019-10241.yml | 36.1.3 |
| 2025-07-01T18:10:59.612806+00:00 | GitLab Importer | Affected by | VCID-uakh-waws-87bk | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty/jetty-server/CVE-2017-7658.yml | 36.1.3 |
| 2025-07-01T18:10:59.353771+00:00 | GitLab Importer | Affected by | VCID-qquy-s15h-d7bd | https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty/jetty-server/CVE-2017-7656.yml | 36.1.3 |