Read the docs
TI-2015-01867 Aliases CVE-2015-2080GHSA-ghgj-3xqr-6jfm

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote…

Priority HIGH 72CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure
Confidentiality · integrity · availability
High · None · None
Fix status
Fixed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA and GitHub. Impact type from CWE-200.

Summary

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Why it matters now

EPSS 0.75441 99th percentileScored 2026-11-07
Public exploit Yes 4 exploit referencesTagged by NVD
Fix Fixed org.eclipse.jetty:jetty-server (Maven): 9.2.9.v20150224

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)before 9.2.9.v201502249.2.9.v20150224Patch availableGHSA-ghgj-3xqr-6jfm
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected before 9.2.9.v20150224 Fixed in 9.2.9.v20150224 Patch available GHSA-ghgj-3xqr-6jfm

CPE configurations NVD · 9

CPEVersionsRoleVendor
cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:*22VulnerableFedoraproject
cpe:2.3:a:eclipse:jetty:9.2.3:*:*:*:*:*:*:*9.2.3VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.2.4:*:*:*:*:*:*:*9.2.4VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.2.5:*:*:*:*:*:*:*9.2.5VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.2.6:*:*:*:*:*:*:*9.2.6VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.2.7:*:*:*:*:*:*:*9.2.7VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.2.8:*:*:*:*:*:*:*9.2.8VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:*9.3.0 m0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:*9.3.0 m1VulnerableEclipse Foundation
  • cpe:2.3:o:fedoraproject:fedora:22:*:*:*:*:*:*:* Versions 22 Vulnerable ·Fedoraproject
  • cpe:2.3:a:eclipse:jetty:9.2.3:*:*:*:*:*:*:* Versions 9.2.3 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.2.4:*:*:*:*:*:*:* Versions 9.2.4 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.2.5:*:*:*:*:*:*:* Versions 9.2.5 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.2.6:*:*:*:*:*:*:* Versions 9.2.6 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.2.7:*:*:*:*:*:*:* Versions 9.2.7 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.2.8:*:*:*:*:*:*:* Versions 9.2.8 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:m0:*:*:*:*:*:* Versions 9.3.0 m0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:m1:*:*:*:*:*:* Versions 9.3.0 m1 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-ghgj-3xqr-6jfm org.eclipse.jetty:jetty-server (Maven) Fixed in 9.2.9.v20150224 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Enterprise 2
  • Red Hat Satellite 5

Timeline

  1. 2026-10-02 Threatist record created from CVE-2015-2080
  2. 2026-10-03 Alias added: GHSA-ghgj-3xqr-6jfm

References

Exploit 4

Advisory 5

Other 2

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences