Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

概要

参考情報

• nvd.nist.gov/vuln/detail/CVE-2016-4800 · ADVISORY
• GitHub Advisory GHSA-872g-2h8h-362q · ADVISORY
• security.netapp.com/advisory/ntap-20190307-0006 · WEB
• oracle.com/security-alerts/cpuoct2020.html · WEB
• dev.eclipse.org/mhonarc/lists/jetty-announce/msg00092.html · WEB
• ocert.org/advisories/ocert-2016-001.html · WEB
• securityfocus.com/bid/90945 · WEB
• zerodayinitiative.com/advisories/ZDI-16-362 · WEB
• security.netapp.com/advisory/ntap-20190307-0006

org.eclipse.jetty:jetty-server のその他の脆弱性

• CVE-2026-6790中 5.3In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what p…
• CVE-2026-10051高 7.5In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the …
• CVE-2024-7708高 7.5For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for…
• CVE-2026-1605高 7.5In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with …
• CVE-2024-13009高 7.2In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request bo…