Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-servletUpgrade jetty-websocket-parentUpgrade jetty-util-ajaxUpgrade jetty-webappUpgrade jetty-proxyUpgrade jetty-utilUpgrade jetty-websocket-clientUpgrade jetty-websocket-servletUpgrade jetty-serverUpgrade jetty-plusUpgrade jetty-xmlUpgrade jetty-runnerUpgrade jetty-websocket-serverUpgrade jetty-websocket-apiUpgrade jetty-jmxUpgrade jetty-jndiUpgrade jetty-continuationUpgrade jetty-jaspiUpgrade jetty-annotationsUpgrade jetty-clientUpgrade jetty-servletsUpgrade jetty-httpUpgrade jetty-websocket-commonUpgrade jetty-monitorUpgrade jetty-securityUpgrade jetty-projectUpgrade jetty-jspc-maven-pluginUpgrade jetty-jaasUpgrade jetty-deployUpgrade jetty-javadocUpgrade jetty-jspUpgrade jetty-antUpgrade jetty-startUpgrade jetty-maven-pluginUpgrade jetty-rewriteUpgrade jetty-io | Feb 21, 2024 | Sep 15, 2023 |
| Debian | — | Upgrade jetty9 | Oct 2, 2023 | Sep 15, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 15, 2023 |
| Suse | — | Upgrade jetty-http-spiUpgrade jetty-jmxUpgrade jetty-webappUpgrade jetty-continuationUpgrade jetty-xmlUpgrade jetty-quickstartUpgrade jetty-jndiUpgrade jetty-startUpgrade jetty-servletsUpgrade jetty-util-ajaxUpgrade jetty-serverUpgrade jetty-rewriteUpgrade jetty-jspUpgrade jetty-annotationsUpgrade jetty-clientUpgrade jetty-deployUpgrade jetty-proxyUpgrade jetty-jaasUpgrade jetty-servletUpgrade jetty-utilUpgrade jetty-openidUpgrade jetty-plusUpgrade jetty-httpUpgrade jetty-minimal-javadocUpgrade jetty-securityUpgrade jetty-fcgiUpgrade jetty-ioUpgrade jetty-antUpgrade jetty-cdi | Oct 27, 2023 | Sep 15, 2023 |
| Ubuntu | — | No solution exists | Jul 1, 2025 | Sep 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub