Read the docs
TI-2021-13463 Aliases CVE-2021-34429GHSA-vjv5-gp2w-65vm

Information disclosure in Eclipse Jetty

Priority HIGH 69CWE-200Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Information disclosure, Security bypass
Confidentiality · integrity · availability
Low · None · None
Fix status
Partial Red Hat: 2 fixed, 8 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200 and CWE-863.

Summary

For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the content of the WEB-INF directory and/or bypass some security constraints. This is a variation of the vulnerability reported in CVE-2021-28164/GHSA-v7ff-8wcx-gmc5.

Why it matters now

EPSS 0.9933 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.eclipse.jetty:jetty-webapp (Maven): 9.4.43, 10.0.6, 11.0.6Red Hat: 2 advisoriesRed Hat: 2 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty9.4.37 and later; up to 9.4.42; 10.0.1 and later; up to 10.0.5; 11.0.1 and later; up to 11.0.5—No fix listedCNA
—org.eclipse.jetty:jetty-webapp (Maven)9.4.37 to before 9.4.439.4.43Patch availableGHSA-vjv5-gp2w-65vm
—org.eclipse.jetty:jetty-webapp (Maven)10.0.1 to before 10.0.610.0.6Patch availableGHSA-vjv5-gp2w-65vm
—org.eclipse.jetty:jetty-webapp (Maven)11.0.1 to before 11.0.611.0.6Patch availableGHSA-vjv5-gp2w-65vm
  • Eclipse Jetty VendorEclipse Foundation Affected 9.4.37 and later; up to 9.4.42; 10.0.1 and later; up to 10.0.5; 11.0.1 and later; up to 11.0.5 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-webapp (Maven) Vendor— Affected 9.4.37 to before 9.4.43 Fixed in 9.4.43 Patch available GHSA-vjv5-gp2w-65vm
  • org.eclipse.jetty:jetty-webapp (Maven) Vendor— Affected 10.0.1 to before 10.0.6 Fixed in 10.0.6 Patch available GHSA-vjv5-gp2w-65vm
  • org.eclipse.jetty:jetty-webapp (Maven) Vendor— Affected 11.0.1 to before 11.0.6 Fixed in 11.0.6 Patch available GHSA-vjv5-gp2w-65vm

CPE configurations NVD · 20

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.4.37 to before 9.4.43; 10.0.1 to before 10.0.6; 11.0.1 to before 11.0.6VulnerableEclipse Foundation
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*11.0 – 11.70.1VulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter_plug-in:-:*:*:*:*:vmware_vsphere:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*21.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:*1.10.0VulnerableOracle
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.4.37 to before 9.4.43; 10.0.1 to before 10.0.6; 11.0.1 to before 11.0.6 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.70.1 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter_plug-in:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_binding_support_function:1.10.0:*:*:*:*:*:*:* Versions 1.10.0 Vulnerable ·Oracle
Show 10 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.5.0:*:*:*:*:*:*:*1.5.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:*8.0.0.0 – 8.5.0.2VulnerableOracle
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:*8.0.8.2.0VulnerableOracle
cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:*8.0.8.3.0VulnerableOracle
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*before 22.1.1VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:*20.0.1VulnerableOracle
cpe:2.3:a:oracle:stream_analytics:*:*:*:*:*:*:*:*before 19.1.0.0.6.4VulnerableOracle
cpe:2.3:a:oracle:stream_analytics:19c:*:*:*:*:*:*:*19cVulnerableOracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_security_edge_protection_proxy:1.5.0:*:*:*:*:*:*:* Versions 1.5.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_service_communication_proxy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_unified_data_repository:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_diameter_signaling_router:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.5.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.2.0:*:*:*:*:*:*:* Versions 8.0.8.2.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:financial_services_crime_and_compliance_management_studio:8.0.8.3.0:*:*:*:*:*:*:* Versions 8.0.8.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* Versions before 22.1.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:20.0.1:*:*:*:*:*:*:* Versions 20.0.1 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:stream_analytics:*:*:*:*:*:*:*:* Versions before 19.1.0.0.6.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:stream_analytics:19c:*:*:*:*:*:*:* Versions 19c Vulnerable ·Oracle

Remediation

  • Fix · GHSA-vjv5-gp2w-65vm org.eclipse.jetty:jetty-webapp (Maven) Fixed in 9.4.43 Advisory →
  • Fix · GHSA-vjv5-gp2w-65vm org.eclipse.jetty:jetty-webapp (Maven) Fixed in 10.0.6 Advisory →
  • Fix · GHSA-vjv5-gp2w-65vm org.eclipse.jetty:jetty-webapp (Maven) Fixed in 11.0.6 Advisory →

Red Hat 2 advisories

  • RHSA-2022:0138 Released 2022-01-13 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.0.0 release and security update
    • Red Hat AMQ Streams 2.0.0
  • RHSA-2021:3700 Released 2021-09-30 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.9.0 release and security update
    • Red Hat AMQ 7.9.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 10 (Newton)AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat AMQ 7.9.0Fixed RHSA-2021:3700
Red Hat AMQ Streams 2.0.0Fixed RHSA-2022:0138
Not affected: 6 products
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat Integration Service Registry
  • Red Hat JBoss Data Grid 7
  • Red Hat OpenShift Container Platform 4

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-34429
  2. 2026-10-03 Alias added: GHSA-vjv5-gp2w-65vm

References

Exploit 1

Patch 3

Advisory 2

Other 69

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2024-14794 Jetty connection leaking on idle timeout when TCP congested CVSS 3.1HIGH 7.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences