There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
CVSS Details
- CVSS 3.1 Base Score: 5.9
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jetty9 | Apr 3, 2025 | Oct 14, 2024 |
| Suse | — | Upgrade jetty-util-ajaxUpgrade jetty-antUpgrade jetty-jndiUpgrade jetty-servletUpgrade jetty-webappUpgrade jetty-deployUpgrade jetty-securityUpgrade jetty-jspUpgrade jetty-http-spiUpgrade jetty-minimal-javadocUpgrade jetty-rewriteUpgrade jetty-quickstartUpgrade jetty-servletsUpgrade jetty-continuationUpgrade jetty-utilUpgrade jetty-serverUpgrade jetty-proxyUpgrade jetty-xmlUpgrade jetty-openidUpgrade jetty-ioUpgrade jetty-clientUpgrade jetty-plusUpgrade jetty-jmxUpgrade jetty-cdiUpgrade jetty-fcgiUpgrade jetty-httpUpgrade jetty-startUpgrade jetty-annotationsUpgrade jetty-jaas | Dec 31, 2024 | Oct 14, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub
