Insufficient session expiration in Eclipse Jetty
Priority LOW 19CWE-613Published · Updated
Key facts
- Attack vector
- Physical
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Security bypass
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 5 fixed, 10 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-613.
Summary
For Eclipse Jetty versions <= 9.4.40, <= 10.0.2, <= 11.0.2, if an exception is thrown from the SessionListener#sessionDestroyed() method, then the session ID is not invalidated in the session ID manager. On deployments with clustered sessions and multiple contexts this can result in a session not being invalidated. This can result in an application used on a shared computer being left logged in.
Why it matters now
EPSS 0.00963 61st percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-server (Maven): 9.4.41, 10.0.3, 11.0.3Red Hat: 5 advisoriesRed Hat: 5 fixed, 10 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | 9.0.0 and later; up to 9.4.40; 10.0.0 and later; up to 10.0.2; 11.0.0 and later; up to 11.0.2 | — | No fix listed | CNA |
| — | org.eclipse.jetty:jetty-server (Maven) | before 9.4.41 | 9.4.41 | Patch available | GHSA-m6cp-vxjx-65j6 |
| — | org.eclipse.jetty:jetty-server (Maven) | 10.0.0 to before 10.0.3 | 10.0.3 | Patch available | GHSA-m6cp-vxjx-65j6 |
| — | org.eclipse.jetty:jetty-server (Maven) | 11.0.0 to before 11.0.3 | 11.0.3 | Patch available | GHSA-m6cp-vxjx-65j6 |
- Eclipse Jetty VendorEclipse Foundation Affected 9.0.0 and later; up to 9.4.40; 10.0.0 and later; up to 10.0.2; 11.0.0 and later; up to 11.0.2 Fixed in — No fix listed CNA
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected before 9.4.41 Fixed in 9.4.41 Patch available GHSA-m6cp-vxjx-65j6
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 10.0.0 to before 10.0.3 Fixed in 10.0.3 Patch available GHSA-m6cp-vxjx-65j6
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 11.0.0 to before 11.0.3 Fixed in 11.0.3 Patch available GHSA-m6cp-vxjx-65j6
CPE configurations NVD · 17
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | up to 9.4.40; 10.0.0 – 10.0.2; 11.0.0 – 11.0.2 | Vulnerable | Eclipse Foundation |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0 – 11.70.1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions up to 9.4.40; 10.0.0 – 10.0.2; 11.0.0 – 11.0.2 Vulnerable ·Eclipse Foundation
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.70.1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* Versions not specified by NVD Vulnerable ·NetApp
Show 7 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:* | 21.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:* | 8.2.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* | 8.0.0.0 – 8.2.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* | 8.0.0 – 8.2.4.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* | before 21.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:* | up to 21.9 | Vulnerable | Oracle |
- cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:* Versions 8.2.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.2.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.4.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* Versions before 21.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:* Versions up to 21.9 Vulnerable ·Oracle
Remediation
- Fix · GHSA-m6cp-vxjx-65j6 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.41 Advisory →
- Fix · GHSA-m6cp-vxjx-65j6 org.eclipse.jetty:jetty-server (Maven) Fixed in 10.0.3 Advisory →
- Fix · GHSA-m6cp-vxjx-65j6 org.eclipse.jetty:jetty-server (Maven) Fixed in 11.0.3 Advisory →
Red Hat 5 advisories
- RHSA-2021:5134 Released 2021-12-14 · Red Hat rating CriticalRed Hat Fuse 7.10.0 release and security update
- Red Hat Fuse 7.10
- RHSA-2021:4767 Released 2021-11-23 · Red Hat rating ModerateRed Hat Integration Camel Extensions for Quarkus GA security update
- Red Hat Integration Camel Quarkus 2
- RHSA-2021:3758 Released 2021-10-18 · Red Hat rating ModerateOpenShift Container Platform 4.9.0 packages and security update
- Red Hat OpenShift Container Platform 4.9 coreos-installer-0.10.0-2.rhaos4.9.el8, coreos-installer-bootinfra-0.10.0-2.rhaos4.9.el8, jenkins-2.289.3.1630554997-1.el8 +10
Show 2 more Red Hat advisories
- RHSA-2021:3700 Released 2021-09-30 · Red Hat rating ModerateRed Hat AMQ Broker 7.9.0 release and security update
- Red Hat AMQ 7.9.0
- RHSA-2021:3225 Released 2021-08-19 · Red Hat rating ModerateRed Hat AMQ Streams 1.8.0 release and security update
- Red Hat AMQ Streams 1.8.0
Vendor assessments
Red Hat
Red Hat rating: Low. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Enterprise Linux 8 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel K 1 | Affected | No fix yet: Fix deferred |
| Red Hat Integration Camel Quarkus 1 | Affected | No fix yet |
| Red Hat Integration Service Registry | Affected | No fix yet |
| Red Hat JBoss A-MQ 6 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Out of support scope |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Will not fix |
| Red Hat OpenShift Container Platform 4 | Affected | No fix planned: Will not fix |
| Red Hat OpenStack Platform 13 (Queens) | Affected | No fix planned: Out of support scope |
| Red Hat AMQ 7.9.0 | Fixed | RHSA-2021:3700 |
| Red Hat AMQ Streams 1.8.0 | Fixed | RHSA-2021:3225 |
| Red Hat Fuse 7.10 | Fixed | RHSA-2021:5134 |
| Red Hat Integration Camel Quarkus 2 | Fixed | RHSA-2021:4767 |
| Red Hat OpenShift Container Platform 4.9 | Fixed | RHSA-2021:3758 |
Not affected: 2 products
- Red Hat JBoss Data Grid 7
- Red Hat OpenShift Container Platform 4.9
Timeline
- 2026-10-02 Threatist record created from CVE-2021-34428
- 2026-10-03 Alias added: GHSA-m6cp-vxjx-65j6
References
Patch 2
Advisory 5
Other 14
- [kafka-jira] 20210623 [GitHub] [kafka] dongjinleekr opened a new pull request #10919: KAFKA-12985: CVE-2021-28169 - Upgrade jetty to 9.4.41
- [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , - Upgrade jetty to 9.4.42
- [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, - Upgrade jetty to 9.4.42
- [zookeeper-issues] 20210928 [jira] [Updated] (ZOOKEEPER-4390) CVE-2021-28169 , CVE-2021-28163, CVE-2021-34428- Upgrade jetty to 9.4.42
- https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084%40%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd%40%3Cnotifications.zookeeper.apache.org%3E
- https://github.com/eclipse/jetty.project
- https://lists.apache.org/thread.html/r67c4f90658fde875521c949448c54c98517beecdc7f618f902c620ec@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/r8a1a332899a1f92c8118b0895b144b27a78e3f25b9d58a34dd5eb084@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rbefa055282d52d6b58d29a79fbb0be65ab0a38d25f00bd29eaf5e6fd@%3Cnotifications.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/rddbb4f8d5db23265bb63d14ef4b3723b438abc1589f877db11d35450@%3Cissues.zookeeper.apache.org%3E
- https://lists.apache.org/thread.html/ref1c161a1621504e673f9197b49e6efe5a33ce3f0e6d8f1f804fc695@%3Cjira.kafka.apache.org%3E
- https://lists.apache.org/thread.html/rf36f1114e84a3379b20587063686148e2d5a39abc0b8a66ff2a9087a@%3Cissues.zookeeper.apache.org%3E
- https://security.netapp.com/advisory/ntap-20210813-0003
More Eclipse Foundation Jetty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
- TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
- TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
- TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
- TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
Sources
- CVE-2021-34428 · CVE Program
- CVE-2021-34428 · NVD
- FIRST EPSS
- GHSA-m6cp-vxjx-65j6 · GitHub Advisory Database · CC BY 4.0
- CVE-2021-34428 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences