Read the docs
TI-2024-07591 Aliases CVE-2024-8184GHSA-g8m5-722r-8whq

Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

Priority LOW 31CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
Low
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 3 fixed, 10 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0103 63rd percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-server (Maven): 12.0.9, 10.0.24, 11.0.24 +1Red Hat: 3 advisoriesRed Hat: 3 fixed, 10 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
No
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationJetty9.3.12 – 9.4.55; 10.0.0 – 10.0.23; 11.0.0 – 11.0.23; 12.0.0 – 12.0.8—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)12.0.0 to before 12.0.912.0.9Patch availableGHSA-g8m5-722r-8whq
—org.eclipse.jetty:jetty-server (Maven)10.0.0 to before 10.0.2410.0.24Patch availableGHSA-g8m5-722r-8whq
—org.eclipse.jetty:jetty-server (Maven)11.0.0 to before 11.0.2411.0.24Patch availableGHSA-g8m5-722r-8whq
—org.eclipse.jetty:jetty-server (Maven)9.3.12 to before 9.4.569.4.56Patch availableGHSA-g8m5-722r-8whq
  • Jetty VendorEclipse Foundation Affected 9.3.12 – 9.4.55; 10.0.0 – 10.0.23; 11.0.0 – 11.0.23; 12.0.0 – 12.0.8 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 12.0.0 to before 12.0.9 Fixed in 12.0.9 Patch available GHSA-g8m5-722r-8whq
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 10.0.0 to before 10.0.24 Fixed in 10.0.24 Patch available GHSA-g8m5-722r-8whq
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 11.0.0 to before 11.0.24 Fixed in 11.0.24 Patch available GHSA-g8m5-722r-8whq
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.3.12 to before 9.4.56 Fixed in 9.4.56 Patch available GHSA-g8m5-722r-8whq

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.3.12 to before 9.4.56; 10.0.0 to before 10.0.24; 11.0.0 to before 11.0.24; 12.0.0 to before 12.0.9VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.3.12 to before 9.4.56; 10.0.0 to before 10.0.24; 11.0.0 to before 11.0.24; 12.0.0 to before 12.0.9 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-g8m5-722r-8whq org.eclipse.jetty:jetty-server (Maven) Fixed in 12.0.9 Advisory →
  • Fix · GHSA-g8m5-722r-8whq org.eclipse.jetty:jetty-server (Maven) Fixed in 10.0.24 Advisory →
  • Fix · GHSA-g8m5-722r-8whq org.eclipse.jetty:jetty-server (Maven) Fixed in 11.0.24 Advisory →
  • Fix · GHSA-g8m5-722r-8whq org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.56 Advisory →

Red Hat 3 advisories

  • RHSA-2025:2416 Released 2025-03-05 · Red Hat rating Important
    Streams for Apache Kafka 2.9.0 release and security update
    • Streams for Apache Kafka 2.9.0
  • RHSA-2024:11023 Released 2024-12-12 · Red Hat rating Important
    HawtIO 4.1.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO 4.0.0 for Red Hat build of Apache Camel 4
  • RHSA-2024:9571 Released 2024-11-13 · Red Hat rating Moderate
    Streams for Apache Kafka 2.8.0 release and security update
    • Streams for Apache Kafka 2.8.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat AMQ Broker 7AffectedNo fix yet
Red Hat AMQ ClientsAffectedNo fix yet: Fix deferred
Red Hat Build of KeycloakAffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform Expansion PackAffectedNo fix yet
Red Hat Process Automation 7AffectedNo fix planned: Will not fix
Red Hat Single Sign-On 7AffectedNo fix planned: Will not fix
HawtIO 4.0.0 for Red Hat build of Apache Camel 4Fixed RHSA-2024:11023
Streams for Apache Kafka 2.8.0Fixed RHSA-2024:9571
Streams for Apache Kafka 2.9.0Fixed RHSA-2025:2416
Not affected: 6 products
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Web Server 6
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2024-8184
  2. 2026-10-03 Alias added: GHSA-g8m5-722r-8whq
  3. 2026-11-05 Affected versions changed · Red Hat

References

Patch 1

Advisory 3

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences