There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jetty9 | Apr 3, 2025 | Oct 14, 2024 |
| Suse | — | Upgrade jetty-startUpgrade jetty-clientUpgrade jetty-ioUpgrade jetty-jaasUpgrade jetty-jmxUpgrade jetty-cdiUpgrade jetty-annotationsUpgrade jetty-httpUpgrade jetty-fcgiUpgrade jetty-plusUpgrade jetty-openidUpgrade jetty-deployUpgrade jetty-utilUpgrade jetty-rewriteUpgrade jetty-serverUpgrade jetty-securityUpgrade jetty-antUpgrade jetty-util-ajaxUpgrade jetty-servletsUpgrade jetty-servletUpgrade jetty-jspUpgrade jetty-http-spiUpgrade jetty-minimal-javadocUpgrade jetty-quickstartUpgrade jetty-xmlUpgrade jetty-proxyUpgrade jetty-continuationUpgrade jetty-jndiUpgrade jetty-webapp | Dec 31, 2024 | Oct 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub