Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-jspUpgrade jetty-javadocUpgrade jetty-monitorUpgrade jetty-jaasUpgrade jetty-projectUpgrade jetty-maven-pluginUpgrade jetty-securityUpgrade jetty-antUpgrade jetty-startUpgrade jetty-jspc-maven-pluginUpgrade jetty-websocket-commonUpgrade jetty-servletsUpgrade jetty-deployUpgrade jetty-ioUpgrade jetty-rewriteUpgrade jetty-httpUpgrade jetty-plusUpgrade jetty-continuationUpgrade jetty-websocket-clientUpgrade jetty-serverUpgrade jetty-xmlUpgrade jetty-webappUpgrade jetty-proxyUpgrade jetty-utilUpgrade jetty-runnerUpgrade jetty-jaspiUpgrade jetty-jndiUpgrade jetty-websocket-serverUpgrade jetty-websocket-servletUpgrade jetty-websocket-parentUpgrade jetty-servletUpgrade jetty-clientUpgrade jetty-websocket-apiUpgrade jetty-util-ajaxUpgrade jetty-jmxUpgrade jetty-annotations | Feb 21, 2024 | Sep 15, 2023 |
| Debian | — | Upgrade jetty9 | Oct 2, 2023 | Sep 15, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 15, 2023 |
| Suse | — | Upgrade jetty-servletUpgrade jetty-fcgiUpgrade jetty-securityUpgrade jetty-jspUpgrade jetty-openidUpgrade jetty-cdiUpgrade jetty-minimal-javadocUpgrade jetty-antUpgrade jetty-jaasUpgrade jetty-plusUpgrade jetty-rewriteUpgrade jetty-annotationsUpgrade jetty-clientUpgrade jetty-proxyUpgrade jetty-ioUpgrade jetty-httpUpgrade jetty-utilUpgrade jetty-deployUpgrade jetty-http-spiUpgrade jetty-xmlUpgrade jetty-jmxUpgrade jetty-serverUpgrade jetty-servletsUpgrade jetty-startUpgrade jetty-continuationUpgrade jetty-quickstartUpgrade jetty-util-ajaxUpgrade jetty-webappUpgrade jetty-jndi | Oct 27, 2023 | Sep 15, 2023 |
| Ubuntu | — | No solution exists | Jul 1, 2025 | Sep 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub