Vulnerability · Published Oct 14, 2024 · Assigned by eclipse
CVE-2024-8184Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
Medium 5.9
In plain English
A medium-severity uncontrolled resource consumption in Jetty from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.0% (higher than 64% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jetty9 | 9.4.57-0+deb12u1 | DSA-5894-1 |
| Debian:12 | jetty9 | 9.4.57-0+deb12u1 | DEBIAN-CVE-2024-8184 |
| Debian:13 | jetty9 | 9.4.56-1 | DEBIAN-CVE-2024-8184 |
| Debian:14 | jetty9 | 9.4.56-1 | DEBIAN-CVE-2024-8184 |
| Maven | org.eclipse.jetty:jetty-server | 11.0.24 | GHSA-g8m5-722r-8whq |
| Maven | org.eclipse.jetty:jetty-server | 9.4.56 | GHSA-g8m5-722r-8whq |
| Maven | org.eclipse.jetty:jetty-server | 12.0.9 | GHSA-g8m5-722r-8whq |
| Maven | org.eclipse.jetty:jetty-server | 10.0.24 | GHSA-g8m5-722r-8whq |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Jetty | 9.3.12 – through 9.4.5510.0.0 – through 10.0.2311.0.0 – through 11.0.2312.0.0 – through 12.0.8 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H