Unescaped exception messages in error responses in Jetty

Description

References

• nvd.nist.gov/vuln/detail/CVE-2019-17632 · ADVISORY
• bugs.eclipse.org/bugs/show_bug.cgi · WEB
• lists.fedoraproject.org/archives/list/[email protected]/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS · WEB
• oracle.com/security-alerts/cpuApr2021.html · WEB
• oracle.com/security-alerts/cpuoct2020.html · WEB
• lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/SAITZ27GKPD2CCNHGT2VBT4VWIBUJJNS

Weitere Schwachstellen in org.eclipse.jetty:jetty-server

• CVE-2026-6790MITTEL 5.3In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what p…
• CVE-2026-10051HOCH 7.5In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the …
• CVE-2024-7708HOCH 7.5For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for…
• CVE-2026-1605HOCH 7.5In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with …
• CVE-2024-13009HOCH 7.2In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request bo…