Read the docs
TI-2018-09004 Aliases CVE-2018-12545GHSA-h2f4-v4c4-6wx4

Uncontrolled resource consumption in Eclipse Jetty

Priority MEDIUM 41CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 4 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

Why it matters now

EPSS 0.05124 92nd percentileScored 2026-11-07
Fix Partial Eclipse Jetty (The Eclipse Foundation): 9.4.12org.eclipse.jetty:jetty-server (Maven): 9.4.12.v20180830, 9.3.25.v20180904Red Hat: 4 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty9.3.0 and later; before 9.4.129.4.12Patch availableCNA
—org.eclipse.jetty:jetty-server (Maven)9.4.0 to before 9.4.12.v201808309.4.12.v20180830Patch availableGHSA-h2f4-v4c4-6wx4
—org.eclipse.jetty:jetty-server (Maven)9.3.0 to before 9.3.25.v201809049.3.25.v20180904Patch availableGHSA-h2f4-v4c4-6wx4
  • Eclipse Jetty VendorEclipse Foundation Affected 9.3.0 and later; before 9.4.12 Fixed in 9.4.12 Patch available CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.0 to before 9.4.12.v20180830 Fixed in 9.4.12.v20180830 Patch available GHSA-h2f4-v4c4-6wx4
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.3.0 to before 9.3.25.v20180904 Fixed in 9.3.25.v20180904 Patch available GHSA-h2f4-v4c4-6wx4

CPE configurations NVD · 85

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:9.3.0:20150601:*:*:*:*:*:*9.3.0 20150601VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:20150608:*:*:*:*:*:*9.3.0 20150608VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:20150612:*:*:*:*:*:*9.3.0 20150612VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:maintenance0:*:*:*:*:*:*9.3.0 maintenance0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:maintenance1:*:*:*:*:*:*9.3.0 maintenance1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*9.3.0 maintenance2VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*9.3.0 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*9.3.0 rc1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.1:20150714:*:*:*:*:*:*9.3.1 20150714VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.2:20150730:*:*:*:*:*:*9.3.2 20150730VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:20150601:*:*:*:*:*:* Versions 9.3.0 20150601 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:20150608:*:*:*:*:*:* Versions 9.3.0 20150608 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:20150612:*:*:*:*:*:* Versions 9.3.0 20150612 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:maintenance0:*:*:*:*:*:* Versions 9.3.0 maintenance0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:maintenance1:*:*:*:*:*:* Versions 9.3.0 maintenance1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:* Versions 9.3.0 maintenance2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:* Versions 9.3.0 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:* Versions 9.3.0 rc1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.1:20150714:*:*:*:*:*:* Versions 9.3.1 20150714 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.2:20150730:*:*:*:*:*:* Versions 9.3.2 20150730 Vulnerable ·Eclipse Foundation
Show 75 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:9.3.3:20150825:*:*:*:*:*:*9.3.3 20150825VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.3:20150827:*:*:*:*:*:*9.3.3 20150827VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.4:20151005:*:*:*:*:*:*9.3.4 20151005VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.4:20151007:*:*:*:*:*:*9.3.4 20151007VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:*9.3.4 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:*9.3.4 rc1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.5:20151012:*:*:*:*:*:*9.3.5 20151012VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.6:20151106:*:*:*:*:*:*9.3.6 20151106VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.7:20160115:*:*:*:*:*:*9.3.7 20160115VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:*9.3.7 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:*9.3.7 rc1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.8:20160311:*:*:*:*:*:*9.3.8 20160311VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.8:20160314:*:*:*:*:*:*9.3.8 20160314VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:*9.3.8 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.9:20160517:*:*:*:*:*:*9.3.9 20160517VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_0:*:*:*:*:*:*9.3.9 maintenance_0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_1:*:*:*:*:*:*9.3.9 maintenance_1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.10:20160621:*:*:*:*:*:*9.3.10 20160621VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.10:maintenance_0:*:*:*:*:*:*9.3.10 maintenance_0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.11:20160721:*:*:*:*:*:*9.3.11 20160721VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.11:maintenance_0:*:*:*:*:*:*9.3.11 maintenance_0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.12:20160915:*:*:*:*:*:*9.3.12 20160915VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.13:20161014:*:*:*:*:*:*9.3.13 20161014VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.13:maintenance_0:*:*:*:*:*:*9.3.13 maintenance_0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.14:20161028:*:*:*:*:*:*9.3.14 20161028VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.15:20161220:*:*:*:*:*:*9.3.15 20161220VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.16:20170119:*:*:*:*:*:*9.3.16 20170119VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.16:20170120:*:*:*:*:*:*9.3.16 20170120VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.17:20170317:*:*:*:*:*:*9.3.17 20170317VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.17:rc0:*:*:*:*:*:*9.3.17 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.18:20170406:*:*:*:*:*:*9.3.18 20170406VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.19:20170502:*:*:*:*:*:*9.3.19 20170502VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.20:20170531:*:*:*:*:*:*9.3.20 20170531VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.21:20170918:*:*:*:*:*:*9.3.21 20170918VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.21:maintenance_0:*:*:*:*:*:*9.3.21 maintenance_0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.21:rc0:*:*:*:*:*:*9.3.21 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.22:20171030:*:*:*:*:*:*9.3.22 20171030VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.23:20180228:*:*:*:*:*:*9.3.23 20180228VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.3.24:20180605:*:*:*:*:*:*9.3.24 20180605VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.0:20161207:*:*:*:*:*:*9.4.0 20161207VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.0:20161208:*:*:*:*:*:*9.4.0 20161208VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.0:20180619:*:*:*:*:*:*9.4.0 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.0:maintenance_0:*:*:*:*:*:*9.4.0 maintenance_0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.0:maintenance_1:*:*:*:*:*:*9.4.0 maintenance_1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.0:rc0:*:*:*:*:*:*9.4.0 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.0:rc1:*:*:*:*:*:*9.4.0 rc1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.0:rc2:*:*:*:*:*:*9.4.0 rc2VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.0:rc3:*:*:*:*:*:*9.4.0 rc3VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.1:20170120:*:*:*:*:*:*9.4.1 20170120VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.1:20180619:*:*:*:*:*:*9.4.1 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.2:20170220:*:*:*:*:*:*9.4.2 20170220VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.2:20180619:*:*:*:*:*:*9.4.2 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.3:20170317:*:*:*:*:*:*9.4.3 20170317VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.3:20180619:*:*:*:*:*:*9.4.3 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.4:20170410:*:*:*:*:*:*9.4.4 20170410VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.4:20170414:*:*:*:*:*:*9.4.4 20170414VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.4:20180619:*:*:*:*:*:*9.4.4 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.5:20170502:*:*:*:*:*:*9.4.5 20170502VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.5:20180619:*:*:*:*:*:*9.4.5 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.6:20170531:*:*:*:*:*:*9.4.6 20170531VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.6:20180619:*:*:*:*:*:*9.4.6 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.7:20170914:*:*:*:*:*:*9.4.7 20170914VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.7:20180619:*:*:*:*:*:*9.4.7 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.7:rc0:*:*:*:*:*:*9.4.7 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.8:20171121:*:*:*:*:*:*9.4.8 20171121VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.8:20180619:*:*:*:*:*:*9.4.8 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.9:20180320:*:*:*:*:*:*9.4.9 20180320VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.10:20180503:*:*:*:*:*:*9.4.10 20180503VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.10:rc0:*:*:*:*:*:*9.4.10 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.10:rc1:*:*:*:*:*:*9.4.10 rc1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.11:20180605:*:*:*:*:*:*9.4.11 20180605VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.12:rc0:*:*:*:*:*:*9.4.12 rc0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.12:rc1:*:*:*:*:*:*9.4.12 rc1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.12:rc2:*:*:*:*:*:*9.4.12 rc2VulnerableEclipse Foundation
cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*28VulnerableFedoraproject
  • cpe:2.3:a:eclipse:jetty:9.3.3:20150825:*:*:*:*:*:* Versions 9.3.3 20150825 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.3:20150827:*:*:*:*:*:* Versions 9.3.3 20150827 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.4:20151005:*:*:*:*:*:* Versions 9.3.4 20151005 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.4:20151007:*:*:*:*:*:* Versions 9.3.4 20151007 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:* Versions 9.3.4 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:* Versions 9.3.4 rc1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.5:20151012:*:*:*:*:*:* Versions 9.3.5 20151012 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.6:20151106:*:*:*:*:*:* Versions 9.3.6 20151106 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.7:20160115:*:*:*:*:*:* Versions 9.3.7 20160115 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:* Versions 9.3.7 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:* Versions 9.3.7 rc1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.8:20160311:*:*:*:*:*:* Versions 9.3.8 20160311 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.8:20160314:*:*:*:*:*:* Versions 9.3.8 20160314 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:* Versions 9.3.8 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.9:20160517:*:*:*:*:*:* Versions 9.3.9 20160517 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_0:*:*:*:*:*:* Versions 9.3.9 maintenance_0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_1:*:*:*:*:*:* Versions 9.3.9 maintenance_1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.10:20160621:*:*:*:*:*:* Versions 9.3.10 20160621 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.10:maintenance_0:*:*:*:*:*:* Versions 9.3.10 maintenance_0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.11:20160721:*:*:*:*:*:* Versions 9.3.11 20160721 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.11:maintenance_0:*:*:*:*:*:* Versions 9.3.11 maintenance_0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.12:20160915:*:*:*:*:*:* Versions 9.3.12 20160915 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.13:20161014:*:*:*:*:*:* Versions 9.3.13 20161014 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.13:maintenance_0:*:*:*:*:*:* Versions 9.3.13 maintenance_0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.14:20161028:*:*:*:*:*:* Versions 9.3.14 20161028 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.15:20161220:*:*:*:*:*:* Versions 9.3.15 20161220 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.16:20170119:*:*:*:*:*:* Versions 9.3.16 20170119 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.16:20170120:*:*:*:*:*:* Versions 9.3.16 20170120 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.17:20170317:*:*:*:*:*:* Versions 9.3.17 20170317 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.17:rc0:*:*:*:*:*:* Versions 9.3.17 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.18:20170406:*:*:*:*:*:* Versions 9.3.18 20170406 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.19:20170502:*:*:*:*:*:* Versions 9.3.19 20170502 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.20:20170531:*:*:*:*:*:* Versions 9.3.20 20170531 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.21:20170918:*:*:*:*:*:* Versions 9.3.21 20170918 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.21:maintenance_0:*:*:*:*:*:* Versions 9.3.21 maintenance_0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.21:rc0:*:*:*:*:*:* Versions 9.3.21 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.22:20171030:*:*:*:*:*:* Versions 9.3.22 20171030 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.23:20180228:*:*:*:*:*:* Versions 9.3.23 20180228 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.3.24:20180605:*:*:*:*:*:* Versions 9.3.24 20180605 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.0:20161207:*:*:*:*:*:* Versions 9.4.0 20161207 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.0:20161208:*:*:*:*:*:* Versions 9.4.0 20161208 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.0:20180619:*:*:*:*:*:* Versions 9.4.0 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.0:maintenance_0:*:*:*:*:*:* Versions 9.4.0 maintenance_0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.0:maintenance_1:*:*:*:*:*:* Versions 9.4.0 maintenance_1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.0:rc0:*:*:*:*:*:* Versions 9.4.0 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.0:rc1:*:*:*:*:*:* Versions 9.4.0 rc1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.0:rc2:*:*:*:*:*:* Versions 9.4.0 rc2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.0:rc3:*:*:*:*:*:* Versions 9.4.0 rc3 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.1:20170120:*:*:*:*:*:* Versions 9.4.1 20170120 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.1:20180619:*:*:*:*:*:* Versions 9.4.1 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.2:20170220:*:*:*:*:*:* Versions 9.4.2 20170220 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.2:20180619:*:*:*:*:*:* Versions 9.4.2 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.3:20170317:*:*:*:*:*:* Versions 9.4.3 20170317 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.3:20180619:*:*:*:*:*:* Versions 9.4.3 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.4:20170410:*:*:*:*:*:* Versions 9.4.4 20170410 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.4:20170414:*:*:*:*:*:* Versions 9.4.4 20170414 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.4:20180619:*:*:*:*:*:* Versions 9.4.4 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.5:20170502:*:*:*:*:*:* Versions 9.4.5 20170502 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.5:20180619:*:*:*:*:*:* Versions 9.4.5 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.6:20170531:*:*:*:*:*:* Versions 9.4.6 20170531 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.6:20180619:*:*:*:*:*:* Versions 9.4.6 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.7:20170914:*:*:*:*:*:* Versions 9.4.7 20170914 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.7:20180619:*:*:*:*:*:* Versions 9.4.7 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.7:rc0:*:*:*:*:*:* Versions 9.4.7 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.8:20171121:*:*:*:*:*:* Versions 9.4.8 20171121 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.8:20180619:*:*:*:*:*:* Versions 9.4.8 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.9:20180320:*:*:*:*:*:* Versions 9.4.9 20180320 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.10:20180503:*:*:*:*:*:* Versions 9.4.10 20180503 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.10:rc0:*:*:*:*:*:* Versions 9.4.10 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.10:rc1:*:*:*:*:*:* Versions 9.4.10 rc1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.11:20180605:*:*:*:*:*:* Versions 9.4.11 20180605 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.12:rc0:*:*:*:*:*:* Versions 9.4.12 rc0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.12:rc1:*:*:*:*:*:* Versions 9.4.12 rc1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.12:rc2:*:*:*:*:*:* Versions 9.4.12 rc2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:* Versions 28 Vulnerable ·Fedoraproject

Remediation

  • Fix · CNA Eclipse Jetty (The Eclipse Foundation) Fixed in 9.4.12
  • Fix · GHSA-h2f4-v4c4-6wx4 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.12.v20180830 Advisory →
  • Fix · GHSA-h2f4-v4c4-6wx4 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.3.25.v20180904 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat Satellite 5AffectedNo fix planned: Out of support scope
Red Hat Software CollectionsAffectedNo fix planned: Will not fix
Not affected: 2 products
  • Red Hat Enterprise Linux 6
  • Red Hat Fuse 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2018-12545
  2. 2026-10-03 Alias added: GHSA-h2f4-v4c4-6wx4

References

Patch 1

Advisory 5

Other 11

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences