Read the docs
TI-2024-06268 Aliases CVE-2024-6762GHSA-r7m4-f9h5-gr79

Jetty PushSessionCacheFilter can cause remote DoS attacks

Priority LOW 31CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · NVD. Fix status from CNA and GitHub. Impact type from CWE-400.

Summary

Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00942 61st percentileScored 2026-11-07
Fix Fixed org.eclipse.jetty:jetty-servlets (Maven): 10.0.18, 11.0.18, 12.0.4

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationJetty10.0.0 – 10.0.17; 11.0.0 – 11.0.17; 12.0.0 – 12.0.3—No fix listedCNA
—org.eclipse.jetty:jetty-servlets (Maven)10.0.0 to before 10.0.1810.0.18Patch availableGHSA-r7m4-f9h5-gr79
—org.eclipse.jetty:jetty-servlets (Maven)11.0.0 to before 11.0.1811.0.18Patch availableGHSA-r7m4-f9h5-gr79
—org.eclipse.jetty:jetty-servlets (Maven)12.0.0 to before 12.0.412.0.4Patch availableGHSA-r7m4-f9h5-gr79
  • Jetty VendorEclipse Foundation Affected 10.0.0 – 10.0.17; 11.0.0 – 11.0.17; 12.0.0 – 12.0.3 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-servlets (Maven) Vendor— Affected 10.0.0 to before 10.0.18 Fixed in 10.0.18 Patch available GHSA-r7m4-f9h5-gr79
  • org.eclipse.jetty:jetty-servlets (Maven) Vendor— Affected 11.0.0 to before 11.0.18 Fixed in 11.0.18 Patch available GHSA-r7m4-f9h5-gr79
  • org.eclipse.jetty:jetty-servlets (Maven) Vendor— Affected 12.0.0 to before 12.0.4 Fixed in 12.0.4 Patch available GHSA-r7m4-f9h5-gr79

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*10.0.0 to before 10.0.18; 11.0.0 to before 11.0.18; 12.0.0 to before 12.0.4VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 10.0.0 to before 10.0.18; 11.0.0 to before 11.0.18; 12.0.0 to before 12.0.4 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-r7m4-f9h5-gr79 org.eclipse.jetty:jetty-servlets (Maven) Fixed in 10.0.18 Advisory →
  • Fix · GHSA-r7m4-f9h5-gr79 org.eclipse.jetty:jetty-servlets (Maven) Fixed in 11.0.18 Advisory →
  • Fix · GHSA-r7m4-f9h5-gr79 org.eclipse.jetty:jetty-servlets (Maven) Fixed in 12.0.4 Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

Not affected: 17 products
  • A-MQ Clients 2
  • OpenShift Serverless
  • Red Hat Build of Keycloak
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat JBoss Data Grid 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 3
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 2
  • streams for Apache Kafka

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-6762
  2. 2026-10-03 Alias added: GHSA-r7m4-f9h5-gr79

References

Patch 4

Advisory 3

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences