Jetty DOS vulnerability on DosFilter
Priority MEDIUM 41CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 1 fixed, 7 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.0094 61st percentileScored 2026-11-07
Fix Partial Jetty (Eclipse Foundation): 9.4.54, 10.0.18, 11.0.18Jetty (Eclipse Jetty): 12.0.3+4 more productsRed Hat: 1 advisoryRed Hat: 1 fixed, 7 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Jetty | 9.0.0 to before 9.4.54; 10.0.0 to before 10.0.18; 11.0.0 to before 11.0.18 | 9.4.54, 10.0.18, 11.0.18 | Patch available | CNA |
| Eclipse Jetty | Jetty | 12.0.0 to before 12.0.3 | 12.0.3 | Patch available | CNA |
| Eclipse Jetty | Jetty | 12.0.0 to before 12.0.3 | 12.0.3 | Patch available | CNA |
| Eclipse Jetty | Jetty | 12.0.0 to before 12.0.3 | 12.0.3 | Patch available | CNA |
| — | org.eclipse.jetty.ee10:jetty-ee10-servlets (Maven) | 12.0.0 to before 12.0.3 | 12.0.3 | Patch available | GHSA-j26w-f9rq-mr2q |
| — | org.eclipse.jetty.ee8:jetty-ee8-servlets (Maven) | 12.0.0 to before 12.0.3 | 12.0.3 | Patch available | GHSA-j26w-f9rq-mr2q |
| — | org.eclipse.jetty.ee9:jetty-ee9-servlets (Maven) | 12.0.0 to before 12.0.3 | 12.0.3 | Patch available | GHSA-j26w-f9rq-mr2q |
| — | org.eclipse.jetty:jetty-servlets (Maven) | 9.0.0 to before 9.4.54 | 9.4.54 | Patch available | GHSA-j26w-f9rq-mr2q |
| — | org.eclipse.jetty:jetty-servlets (Maven) | 10.0.0 to before 10.0.18 | 10.0.18 | Patch available | GHSA-j26w-f9rq-mr2q |
| — | org.eclipse.jetty:jetty-servlets (Maven) | 11.0.0 to before 11.0.18 | 11.0.18 | Patch available | GHSA-j26w-f9rq-mr2q |
- Jetty VendorEclipse Foundation Affected 9.0.0 to before 9.4.54; 10.0.0 to before 10.0.18; 11.0.0 to before 11.0.18 Fixed in 9.4.54, 10.0.18, 11.0.18 Patch available CNA
- Jetty VendorEclipse Jetty Affected 12.0.0 to before 12.0.3 Fixed in 12.0.3 Patch available CNA
- Jetty VendorEclipse Jetty Affected 12.0.0 to before 12.0.3 Fixed in 12.0.3 Patch available CNA
- Jetty VendorEclipse Jetty Affected 12.0.0 to before 12.0.3 Fixed in 12.0.3 Patch available CNA
- org.eclipse.jetty.ee10:jetty-ee10-servlets (Maven) Vendor— Affected 12.0.0 to before 12.0.3 Fixed in 12.0.3 Patch available GHSA-j26w-f9rq-mr2q
- org.eclipse.jetty.ee8:jetty-ee8-servlets (Maven) Vendor— Affected 12.0.0 to before 12.0.3 Fixed in 12.0.3 Patch available GHSA-j26w-f9rq-mr2q
- org.eclipse.jetty.ee9:jetty-ee9-servlets (Maven) Vendor— Affected 12.0.0 to before 12.0.3 Fixed in 12.0.3 Patch available GHSA-j26w-f9rq-mr2q
- org.eclipse.jetty:jetty-servlets (Maven) Vendor— Affected 9.0.0 to before 9.4.54 Fixed in 9.4.54 Patch available GHSA-j26w-f9rq-mr2q
- org.eclipse.jetty:jetty-servlets (Maven) Vendor— Affected 10.0.0 to before 10.0.18 Fixed in 10.0.18 Patch available GHSA-j26w-f9rq-mr2q
- org.eclipse.jetty:jetty-servlets (Maven) Vendor— Affected 11.0.0 to before 11.0.18 Fixed in 11.0.18 Patch available GHSA-j26w-f9rq-mr2q
CPE configurations NVD · 6
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | 9.0.0 to before 9.4.54; 10.0.0 to before 10.0.18; 11.0.0 to before 11.0.18; 12.0.0 to before 12.0.3 | Vulnerable | Eclipse Foundation |
| cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* | not specified by NVD | Running on | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.4.54; 10.0.0 to before 10.0.18; 11.0.0 to before 11.0.18; 12.0.0 to before 12.0.3 Vulnerable ·Eclipse Foundation
- cpe:2.3:o:netapp:bootstrap_os:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:vmware_vsphere:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA Jetty (Eclipse Foundation) Fixed in 9.4.54, 10.0.18, 11.0.18
- Fix · CNA Jetty (Eclipse Jetty) Fixed in 12.0.3
- Fix · CNA Jetty (Eclipse Jetty) Fixed in 12.0.3
- Fix · CNA Jetty (Eclipse Jetty) Fixed in 12.0.3
- Fix · GHSA-j26w-f9rq-mr2q org.eclipse.jetty.ee10:jetty-ee10-servlets (Maven) Fixed in 12.0.3 Advisory →
- Fix · GHSA-j26w-f9rq-mr2q org.eclipse.jetty.ee8:jetty-ee8-servlets (Maven) Fixed in 12.0.3 Advisory →
- Fix · GHSA-j26w-f9rq-mr2q org.eclipse.jetty.ee9:jetty-ee9-servlets (Maven) Fixed in 12.0.3 Advisory →
- Fix · GHSA-j26w-f9rq-mr2q org.eclipse.jetty:jetty-servlets (Maven) Fixed in 9.4.54 Advisory →
- Fix · GHSA-j26w-f9rq-mr2q org.eclipse.jetty:jetty-servlets (Maven) Fixed in 10.0.18 Advisory →
- Fix · GHSA-j26w-f9rq-mr2q org.eclipse.jetty:jetty-servlets (Maven) Fixed in 11.0.18 Advisory →
Red Hat 1 advisory
- RHSA-2024:9571 Released 2024-11-13 · Red Hat rating ModerateStreams for Apache Kafka 2.8.0 release and security update
- Streams for Apache Kafka 2.8.0
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Build of Keycloak | Affected | No fix planned: Will not fix |
| Red Hat Fuse 7 | Affected | No fix planned: Out of support scope |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Data Grid 7 | Affected | No fix planned: Out of support scope |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Streams for Apache Kafka 2.8.0 | Fixed | RHSA-2024:9571 |
Not affected: 6 products
- OpenShift Serverless
- Red Hat Data Grid 8
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat build of Apicurio Registry 2
- Red Hat build of Debezium 2
Timeline
- 2026-10-02 Threatist record created from CVE-2024-9823
- 2026-10-03 Alias added: GHSA-j26w-f9rq-mr2q
References
Advisory 4
More Eclipse Foundation Jetty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
- TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
- TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
- TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
- TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-9823 · CVE Program
- CVE-2024-9823 · NVD
- FIRST EPSS
- GHSA-j26w-f9rq-mr2q · GitHub Advisory Database · CC BY 4.0
- CVE-2024-9823 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences