Vulnerability · Published Oct 14, 2024 · Assigned by eclipse
CVE-2024-9823Jetty DOS vulnerability on DosFilter
Medium 5.3
In plain English
A medium-severity uncontrolled resource consumption in Jetty from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.9% (higher than 61% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.
Official description
There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.
Affected packages & fixed versions
| Ecosystem | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian:12 | jetty9 | 9.4.57-0+deb12u1 | DEBIAN-CVE-2024-9823 |
| Debian:12 | jetty9 | 9.4.57-0+deb12u1 | DSA-5894-1 |
| Debian:13 | jetty9 | 9.4.54-1 | DEBIAN-CVE-2024-9823 |
| Debian:14 | jetty9 | 9.4.54-1 | DEBIAN-CVE-2024-9823 |
| Maven | org.eclipse.jetty.ee10:jetty-ee10-servlets | 12.0.3 | GHSA-j26w-f9rq-mr2q |
| Maven | org.eclipse.jetty.ee8:jetty-ee8-servlets | 12.0.3 | GHSA-j26w-f9rq-mr2q |
| Maven | org.eclipse.jetty.ee9:jetty-ee9-servlets | 12.0.3 | GHSA-j26w-f9rq-mr2q |
| Maven | org.eclipse.jetty:jetty-servlets | 9.4.54 | GHSA-j26w-f9rq-mr2q |
| Maven | org.eclipse.jetty:jetty-servlets | 10.0.18 | GHSA-j26w-f9rq-mr2q |
| Maven | org.eclipse.jetty:jetty-servlets | 11.0.18 | GHSA-j26w-f9rq-mr2q |
| Ubuntu:22.04:LTS | jetty9 | no fix listed | UBUNTU-CVE-2024-9823 |
| Ubuntu:24.04:LTS | jetty9 | no fix listed | UBUNTU-CVE-2024-9823 |
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Eclipse Foundation | Jetty | 9.0.0 – before 9.4.5410.0.0 – before 10.0.1811.0.0 – before 11.0.18 |
| Eclipse Jetty | Jetty | 12.0.0 – before 12.0.3 |
| Eclipse Jetty | Jetty | 12.0.0 – before 12.0.3 |
| Eclipse Jetty | Jetty | 12.0.0 – before 12.0.3 |
Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/39
- https://github.com/jetty/jetty.project/issues/1256
- https://security.netapp.com/advisory/ntap-20250306-0006/
- https://lists.debian.org/debian-lts-announce/2025/04/msg00001.html