Search for vulnerabilities
Vulnerability details: VCID-juk7-qcef-zyer
Vulnerability ID VCID-juk7-qcef-zyer
Aliases CVE-2024-13009
GHSA-q4rv-gq96-w7c5
Summary **UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (3)
CWE-404 Improper Resource Shutdown or Release
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
System Score Found at
cvssv3 7.2 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-13009.json
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00028 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00036 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
epss 0.00039 https://api.first.org/data/v1/epss?cve=CVE-2024-13009
cvssv3.1 7.2 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-q4rv-gq96-w7c5
cvssv3.1 7.2 https://github.com/jetty/jetty.project
generic_textual HIGH https://github.com/jetty/jetty.project
cvssv3.1 7.2 https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
cvssv3.1_qr HIGH https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
generic_textual HIGH https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
ssvc Track https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
cvssv3.1 7.2 https://gitlab.eclipse.org/security/cve-assignement/-/issues/48
generic_textual HIGH https://gitlab.eclipse.org/security/cve-assignement/-/issues/48
ssvc Track https://gitlab.eclipse.org/security/cve-assignement/-/issues/48
cvssv3.1 7.2 https://nvd.nist.gov/vuln/detail/CVE-2024-13009
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-13009
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-13009.json
https://api.first.org/data/v1/epss?cve=CVE-2024-13009
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-13009
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/jetty/jetty.project
https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
https://gitlab.eclipse.org/security/cve-assignement/-/issues/48
https://nvd.nist.gov/vuln/detail/CVE-2024-13009
2365135 https://bugzilla.redhat.com/show_bug.cgi?id=2365135
GHSA-q4rv-gq96-w7c5 https://github.com/advisories/GHSA-q4rv-gq96-w7c5
RHSA-2025:9697 https://access.redhat.com/errata/RHSA-2025:9697
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-13009.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/jetty/jetty.project
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T18:55:32Z/ Found at https://github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://gitlab.eclipse.org/security/cve-assignement/-/issues/48
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: SSVCv2/E:N/A:Y/T:P/P:M/B:A/M:M/D:T/2025-05-08T18:55:32Z/ Found at https://gitlab.eclipse.org/security/cve-assignement/-/issues/48
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N Found at https://nvd.nist.gov/vuln/detail/CVE-2024-13009
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.06052
EPSS Score 0.00028
Published At May 9, 2025, 12:55 p.m.
Date Actor Action Source VulnerableCode Version
2025-05-08T20:52:32.396776+00:00 GithubOSV Importer Import https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-q4rv-gq96-w7c5/GHSA-q4rv-gq96-w7c5.json 36.0.0