There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jetty9 | Apr 3, 2025 | Oct 14, 2024 |
| Suse | — | Upgrade jetty-plusUpgrade jetty-cdiUpgrade jetty-jmxUpgrade jetty-fcgiUpgrade jetty-openidUpgrade jetty-startUpgrade jetty-httpUpgrade jetty-ioUpgrade jetty-jaasUpgrade jetty-annotationsUpgrade jetty-clientUpgrade jetty-minimal-javadocUpgrade jetty-serverUpgrade jetty-servletUpgrade jetty-servletsUpgrade jetty-securityUpgrade jetty-proxyUpgrade jetty-deployUpgrade jetty-jndiUpgrade jetty-webappUpgrade jetty-xmlUpgrade jetty-jspUpgrade jetty-http-spiUpgrade jetty-continuationUpgrade jetty-quickstartUpgrade jetty-rewriteUpgrade jetty-antUpgrade jetty-util-ajaxUpgrade jetty-util | Dec 31, 2024 | Oct 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub