In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x…
Priority MEDIUM 42CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- None · High · None
- Fix status
- Partial Red Hat: 1 fixed, 8 without a fix
Attack profile from CVSS 3.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.
Why it matters now
EPSS 0.06107 93rd percentileScored 2026-11-07
Fix Partial Eclipse Jetty (The Eclipse Foundation): 9.3.24, 9.4.11org.eclipse.jetty:jetty-server (Maven): 9.3.24.v20180605, 9.4.11.v20180605Red Hat: 1 advisoryRed Hat: 1 fixed, 8 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | up to 9.2.0; 9.3.0 and later; before 9.3.24; 9.4.0 and later; before 9.4.11 | 9.3.24, 9.4.11 | Patch available | CNA |
| — | org.eclipse.jetty:jetty-server (Maven) | before 9.3.24.v20180605 | 9.3.24.v20180605 | Patch available | GHSA-84q7-p226-4x5w |
| — | org.eclipse.jetty:jetty-server (Maven) | 9.4.0 to before 9.4.11.v20180605 | 9.4.11.v20180605 | Patch available | GHSA-84q7-p226-4x5w |
- Eclipse Jetty VendorEclipse Foundation Affected up to 9.2.0; 9.3.0 and later; before 9.3.24; 9.4.0 and later; before 9.4.11 Fixed in 9.3.24, 9.4.11 Patch available CNA
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected before 9.3.24.v20180605 Fixed in 9.3.24.v20180605 Patch available GHSA-84q7-p226-4x5w
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.0 to before 9.4.11.v20180605 Fixed in 9.4.11.v20180605 Patch available GHSA-84q7-p226-4x5w
CPE configurations NVD · 2
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | up to 9.2.26; 9.3.0 to before 9.3.24; 9.4.0 to before 9.4.11 | Vulnerable | Eclipse Foundation |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions up to 9.2.26; 9.3.0 to before 9.3.24; 9.4.0 to before 9.4.11 Vulnerable ·Eclipse Foundation
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
Remediation
- Fix · CNA Eclipse Jetty (The Eclipse Foundation) Fixed in 9.3.24, 9.4.11
- Fix · GHSA-84q7-p226-4x5w org.eclipse.jetty:jetty-server (Maven) Fixed in 9.3.24.v20180605 Advisory →
- Fix · GHSA-84q7-p226-4x5w org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.11.v20180605 Advisory →
Red Hat 1 advisory
- RHSA-2020:3779 Released 2020-09-17 · Red Hat rating ImportantRed Hat Data Grid 7.3.7 security update
- Red Hat Data Grid 7.3.7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
The Eclipse Foundation Eclipse Jetty — DSA-4278
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2017-05294 In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x…Priority MEDIUM 60
- TI-2017-05293 Integer overflow in Eclipse JettyPriority MEDIUM 57
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat JBoss Data Grid 7 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 5 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix yet |
| Red Hat Data Grid 7.3.7 | Fixed | RHSA-2020:3779 |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7656
- 2026-10-03 Alias added: GHSA-84q7-p226-4x5w
References
Advisory 4
Other 14
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities
- https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html
- [maven-issues] 20200730 [GitHub] [maven-dependency-plugin] slachiewicz commented on pull request #91: Bump jettyVersion from 9.2.28.v20190418 to 9.3.0.v20150612
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/rbf4565a0b63f9c8b07fab29352a97bbffe76ecafed8b8555c15b83c6@%3Cissues.maven.apache.org%3E
- https://security.netapp.com/advisory/ntap-20181014-0001
More Eclipse Foundation Jetty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
- TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
- TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
- TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
- TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
Sources
- CVE-2017-7656 · CVE Program
- CVE-2017-7656 · NVD
- FIRST EPSS
- GHSA-84q7-p226-4x5w · GitHub Advisory Database · CC BY 4.0
- CVE-2017-7656 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences