Read the docs
TI-2004-02252 Aliases CVE-2004-2381GHSA-p5rr-q5g6-gm42

HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause…

Priority LOW 26CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Partial
Fix status
Fixed

Attack profile from CVSS 2.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length.

Why it matters now

EPSS 0.01801 78th percentileScored 2026-11-07
Fix Fixed org.mortbay.jetty:jetty (Maven): 4.2.19

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.mortbay.jetty:jetty (Maven)before 4.2.194.2.19Patch availableGHSA-p5rr-q5g6-gm42
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.mortbay.jetty:jetty (Maven) Vendor— Affected before 4.2.19 Fixed in 4.2.19 Patch available GHSA-p5rr-q5g6-gm42

CPE configurations NVD · 67

CPEVersionsRoleVendor
cpe:2.3:a:jetty:jetty_http_server:4.0.0:*:*:*:*:*:*:*4.0.0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.1:*:*:*:*:*:*:*4.0.1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.1_rc0:*:*:*:*:*:*:*4.0.1_rc0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.1_rc1:*:*:*:*:*:*:*4.0.1_rc1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.1_rc2:*:*:*:*:*:*:*4.0.1_rc2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.2:*:*:*:*:*:*:*4.0.2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.3:*:*:*:*:*:*:*4.0.3Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.4:*:*:*:*:*:*:*4.0.4Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.5:*:*:*:*:*:*:*4.0.5Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.6:*:*:*:*:*:*:*4.0.6Vulnerablejetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.0:*:*:*:*:*:*:* Versions 4.0.0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.1:*:*:*:*:*:*:* Versions 4.0.1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.1_rc0:*:*:*:*:*:*:* Versions 4.0.1_rc0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.1_rc1:*:*:*:*:*:*:* Versions 4.0.1_rc1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.1_rc2:*:*:*:*:*:*:* Versions 4.0.1_rc2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.2:*:*:*:*:*:*:* Versions 4.0.2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.3:*:*:*:*:*:*:* Versions 4.0.3 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.4:*:*:*:*:*:*:* Versions 4.0.4 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.5:*:*:*:*:*:*:* Versions 4.0.5 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.6:*:*:*:*:*:*:* Versions 4.0.6 Vulnerable ·jetty
Show 57 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jetty:jetty_http_server:4.0.b0:*:*:*:*:*:*:*4.0.b0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.b1:*:*:*:*:*:*:*4.0.b1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.b2:*:*:*:*:*:*:*4.0.b2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.d0:*:*:*:*:*:*:*4.0.d0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.d1:*:*:*:*:*:*:*4.0.d1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.d2:*:*:*:*:*:*:*4.0.d2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.d3:*:*:*:*:*:*:*4.0.d3Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0.d4:*:*:*:*:*:*:*4.0.d4Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0_rc1:*:*:*:*:*:*:*4.0_rc1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0_rc2:*:*:*:*:*:*:*4.0_rc2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.0_rc3:*:*:*:*:*:*:*4.0_rc3Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.0:*:*:*:*:*:*:*4.1.0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc0:*:*:*:*:*:*:*4.1.0_rc0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc1:*:*:*:*:*:*:*4.1.0_rc1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc2:*:*:*:*:*:*:*4.1.0_rc2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc3:*:*:*:*:*:*:*4.1.0_rc3Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc4:*:*:*:*:*:*:*4.1.0_rc4Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc5:*:*:*:*:*:*:*4.1.0_rc5Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc6:*:*:*:*:*:*:*4.1.0_rc6Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.1:*:*:*:*:*:*:*4.1.1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.2:*:*:*:*:*:*:*4.1.2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.3:*:*:*:*:*:*:*4.1.3Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.4:*:*:*:*:*:*:*4.1.4Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.b0:*:*:*:*:*:*:*4.1.b0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.b1:*:*:*:*:*:*:*4.1.b1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.d0:*:*:*:*:*:*:*4.1.d0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.d1:*:*:*:*:*:*:*4.1.d1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.1.d2:*:*:*:*:*:*:*4.1.d2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.0:*:*:*:*:*:*:*4.2.0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.0_beta0:*:*:*:*:*:*:*4.2.0_beta0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.0_rc0:*:*:*:*:*:*:*4.2.0_rc0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.0_rc1:*:*:*:*:*:*:*4.2.0_rc1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.1:*:*:*:*:*:*:*4.2.1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.2:*:*:*:*:*:*:*4.2.2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.3:*:*:*:*:*:*:*4.2.3Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.4:*:*:*:*:*:*:*4.2.4Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.4_rc0:*:*:*:*:*:*:*4.2.4_rc0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.5:*:*:*:*:*:*:*4.2.5Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.6:*:*:*:*:*:*:*4.2.6Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.7:*:*:*:*:*:*:*4.2.7Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.8_01:*:*:*:*:*:*:*4.2.8_01Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.9:*:*:*:*:*:*:*4.2.9Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.9_rc1:*:*:*:*:*:*:*4.2.9_rc1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.9_rc2:*:*:*:*:*:*:*4.2.9_rc2Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.10:*:*:*:*:*:*:*4.2.10Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.10_pre0:*:*:*:*:*:*:*4.2.10_pre0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.10_pre1:*:*:*:*:*:*:*4.2.10_pre1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.11:*:*:*:*:*:*:*4.2.11Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.12:*:*:*:*:*:*:*4.2.12Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.14:*:*:*:*:*:*:*4.2.14Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.14_rc0:*:*:*:*:*:*:*4.2.14_rc0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.14_rc1:*:*:*:*:*:*:*4.2.14_rc1Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.15:*:*:*:*:*:*:*4.2.15Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.15_rc0:*:*:*:*:*:*:*4.2.15_rc0Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.16:*:*:*:*:*:*:*4.2.16Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.17:*:*:*:*:*:*:*4.2.17Vulnerablejetty
cpe:2.3:a:jetty:jetty_http_server:4.2.18:*:*:*:*:*:*:*4.2.18Vulnerablejetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.b0:*:*:*:*:*:*:* Versions 4.0.b0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.b1:*:*:*:*:*:*:* Versions 4.0.b1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.b2:*:*:*:*:*:*:* Versions 4.0.b2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.d0:*:*:*:*:*:*:* Versions 4.0.d0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.d1:*:*:*:*:*:*:* Versions 4.0.d1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.d2:*:*:*:*:*:*:* Versions 4.0.d2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.d3:*:*:*:*:*:*:* Versions 4.0.d3 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0.d4:*:*:*:*:*:*:* Versions 4.0.d4 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0_rc1:*:*:*:*:*:*:* Versions 4.0_rc1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0_rc2:*:*:*:*:*:*:* Versions 4.0_rc2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.0_rc3:*:*:*:*:*:*:* Versions 4.0_rc3 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.0:*:*:*:*:*:*:* Versions 4.1.0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc0:*:*:*:*:*:*:* Versions 4.1.0_rc0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc1:*:*:*:*:*:*:* Versions 4.1.0_rc1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc2:*:*:*:*:*:*:* Versions 4.1.0_rc2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc3:*:*:*:*:*:*:* Versions 4.1.0_rc3 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc4:*:*:*:*:*:*:* Versions 4.1.0_rc4 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc5:*:*:*:*:*:*:* Versions 4.1.0_rc5 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.0_rc6:*:*:*:*:*:*:* Versions 4.1.0_rc6 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.1:*:*:*:*:*:*:* Versions 4.1.1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.2:*:*:*:*:*:*:* Versions 4.1.2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.3:*:*:*:*:*:*:* Versions 4.1.3 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.4:*:*:*:*:*:*:* Versions 4.1.4 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.b0:*:*:*:*:*:*:* Versions 4.1.b0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.b1:*:*:*:*:*:*:* Versions 4.1.b1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.d0:*:*:*:*:*:*:* Versions 4.1.d0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.d1:*:*:*:*:*:*:* Versions 4.1.d1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.1.d2:*:*:*:*:*:*:* Versions 4.1.d2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.0:*:*:*:*:*:*:* Versions 4.2.0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.0_beta0:*:*:*:*:*:*:* Versions 4.2.0_beta0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.0_rc0:*:*:*:*:*:*:* Versions 4.2.0_rc0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.0_rc1:*:*:*:*:*:*:* Versions 4.2.0_rc1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.1:*:*:*:*:*:*:* Versions 4.2.1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.2:*:*:*:*:*:*:* Versions 4.2.2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.3:*:*:*:*:*:*:* Versions 4.2.3 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.4:*:*:*:*:*:*:* Versions 4.2.4 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.4_rc0:*:*:*:*:*:*:* Versions 4.2.4_rc0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.5:*:*:*:*:*:*:* Versions 4.2.5 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.6:*:*:*:*:*:*:* Versions 4.2.6 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.7:*:*:*:*:*:*:* Versions 4.2.7 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.8_01:*:*:*:*:*:*:* Versions 4.2.8_01 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.9:*:*:*:*:*:*:* Versions 4.2.9 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.9_rc1:*:*:*:*:*:*:* Versions 4.2.9_rc1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.9_rc2:*:*:*:*:*:*:* Versions 4.2.9_rc2 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.10:*:*:*:*:*:*:* Versions 4.2.10 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.10_pre0:*:*:*:*:*:*:* Versions 4.2.10_pre0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.10_pre1:*:*:*:*:*:*:* Versions 4.2.10_pre1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.11:*:*:*:*:*:*:* Versions 4.2.11 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.12:*:*:*:*:*:*:* Versions 4.2.12 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.14:*:*:*:*:*:*:* Versions 4.2.14 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.14_rc0:*:*:*:*:*:*:* Versions 4.2.14_rc0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.14_rc1:*:*:*:*:*:*:* Versions 4.2.14_rc1 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.15:*:*:*:*:*:*:* Versions 4.2.15 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.15_rc0:*:*:*:*:*:*:* Versions 4.2.15_rc0 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.16:*:*:*:*:*:*:* Versions 4.2.16 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.17:*:*:*:*:*:*:* Versions 4.2.17 Vulnerable ·jetty
  • cpe:2.3:a:jetty:jetty_http_server:4.2.18:*:*:*:*:*:*:* Versions 4.2.18 Vulnerable ·jetty

Remediation

  • Fix · GHSA-p5rr-q5g6-gm42 org.mortbay.jetty:jetty (Maven) Fixed in 4.2.19 Advisory →

Timeline

  1. 2026-10-02 Threatist record created from CVE-2004-2381
  2. 2026-10-03 Alias added: GHSA-p5rr-q5g6-gm42

References

Patch 1

Advisory 1

Other 2

  • TI-2004-02348 Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner… CVSS 2.0HIGH 7.5
  • TI-2002-01139 Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0… CVSS 2.0MEDIUM 5.0
  • TI-2006-06711 Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3… CVSS 2.0MEDIUM 6.8

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences