Eclipse Jetty GZIP buffer release
Priority LOW 38CWE-404Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- Low · Low · None
- Fix status
- Partial Red Hat: 4 fixed, 9 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-404.
Summary
In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00548 46th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-server (Maven): 9.4.57.v20241219Red Hat: 4 advisoriesRed Hat: 4 fixed, 9 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Jetty | 9.4.0 – 9.4.56 | — | No fix listed | CNA |
| — | org.eclipse.jetty:jetty-server (Maven) | 9.4.0 to before 9.4.57.v20241219 | 9.4.57.v20241219 | Patch available | GHSA-q4rv-gq96-w7c5 |
- Jetty VendorEclipse Foundation Affected 9.4.0 – 9.4.56 Fixed in — No fix listed CNA
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.0 to before 9.4.57.v20241219 Fixed in 9.4.57.v20241219 Patch available GHSA-q4rv-gq96-w7c5
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | 9.4.0 to before 9.4.57 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.4.0 to before 9.4.57 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-q4rv-gq96-w7c5 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.57.v20241219 Advisory →
Red Hat 4 advisories
- RHSA-2025:15643 Released 2025-09-10 · Red Hat rating ImportantSatellite 6.15.5.4 Async Update
- Red Hat Satellite 6.15 for RHEL 8 puppetserver-7.17.3.1-1.el8sat
- RHSA-2025:12511 Released 2025-08-01 · Red Hat rating ImportantStreams for Apache Kafka 3.0.0 release and security update
- Streams for Apache Kafka 3.0.0
- RHSA-2025:9922 Released 2025-06-30 · Red Hat rating ImportantStreams for Apache Kafka 2.9.1 release and security update
- Streams for Apache Kafka 2.9.1
Show 1 more Red Hat advisories
- RHSA-2025:9697 Released 2025-06-25 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.10.3 for Spring Boot patch release.
- Red Hat build of Apache Camel 4.10.3 for Spring Boot 3.4.7
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| A-MQ Clients 2 | Affected | No fix yet |
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix planned: Will not fix |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform 7 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat build of Debezium 2 | Affected | No fix planned: Will not fix |
| Red Hat build of Debezium 3 | Affected | No fix planned: Will not fix |
| streams for Apache Kafka | Affected | No fix planned: Will not fix |
| Red Hat Satellite 6.15 for RHEL 8 | Fixed | RHSA-2025:15643 |
| Red Hat build of Apache Camel 4.10.3 for Spring Boot 3.4.7 | Fixed | RHSA-2025:9697 |
| Streams for Apache Kafka 2.9.1 | Fixed | RHSA-2025:9922 |
| Streams for Apache Kafka 3.0.0 | Fixed | RHSA-2025:12511 |
Not affected: 16 products
- OpenShift Developer Tools and Services
- Red Hat AMQ Broker 7
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat JBoss Web Server 6
- Red Hat Offline Knowledge Portal
- Red Hat Process Automation 7
- Red Hat Satellite 6
- Red Hat Satellite 6.15 for RHEL 8
- Red Hat Single Sign-On 7
- Red Hat build of Apache Camel - HawtIO 4
- Red Hat build of Apicurio Registry 2
- Red Hat build of Apicurio Registry 3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-13009
- 2026-10-03 Alias added: GHSA-q4rv-gq96-w7c5
References
More Eclipse Foundation Jetty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
- TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
- TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
- TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
- TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
Sources
- CVE-2024-13009 · CVE Program
- CVE-2024-13009 · NVD
- FIRST EPSS
- GHSA-q4rv-gq96-w7c5 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-13009 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences