Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.
CVSS Details
- CVSS 3.1 Base Score: 5.3
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-websocket-commonUpgrade jetty-securityUpgrade jetty-ioUpgrade jetty-maven-pluginUpgrade jetty-javadocUpgrade jetty-startUpgrade jetty-jspUpgrade jetty-projectUpgrade jetty-deployUpgrade jetty-httpUpgrade jetty-monitorUpgrade jetty-jspc-maven-pluginUpgrade jetty-jaasUpgrade jetty-rewriteUpgrade jetty-antUpgrade jetty-servletsUpgrade jetty-jaspiUpgrade jetty-websocket-apiUpgrade jetty-websocket-servletUpgrade jetty-websocket-parentUpgrade jetty-xmlUpgrade jetty-continuationUpgrade jetty-servletUpgrade jetty-plusUpgrade jetty-jmxUpgrade jetty-serverUpgrade jetty-websocket-clientUpgrade jetty-annotationsUpgrade jetty-clientUpgrade jetty-webappUpgrade jetty-utilUpgrade jetty-proxyUpgrade jetty-util-ajaxUpgrade jetty-websocket-serverUpgrade jetty-runnerUpgrade jetty-jndi | Feb 21, 2024 | Sep 15, 2023 |
| Debian | — | Upgrade jetty9 | Oct 2, 2023 | Sep 15, 2023 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Sep 15, 2023 |
| Suse | — | Upgrade jetty-serverUpgrade jetty-util-ajaxUpgrade jetty-quickstartUpgrade jetty-http-spiUpgrade jetty-xmlUpgrade jetty-jmxUpgrade jetty-servletsUpgrade jetty-startUpgrade jetty-jndiUpgrade jetty-webappUpgrade jetty-continuationUpgrade jetty-cdiUpgrade jetty-securityUpgrade jetty-servletUpgrade jetty-openidUpgrade jetty-fcgiUpgrade jetty-antUpgrade jetty-minimal-javadocUpgrade jetty-utilUpgrade jetty-ioUpgrade jetty-httpUpgrade jetty-jaasUpgrade jetty-plusUpgrade jetty-jspUpgrade jetty-annotationsUpgrade jetty-rewriteUpgrade jetty-proxyUpgrade jetty-deployUpgrade jetty-client | Oct 27, 2023 | Sep 15, 2023 |
| Ubuntu | — | No solution exists | Jul 1, 2025 | Sep 15, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub