**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request

概要

参考情報

• jetty/jetty.project security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2024-13009 · ADVISORY
• jetty/jetty.project · PACKAGE
• gitlab.eclipse.org/security/cve-assignement/-/issues/48 · WEB

org.eclipse.jetty:jetty-server のその他の脆弱性

• CVE-2026-6790中 5.3In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what p…
• CVE-2026-10051高 7.5In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the …
• CVE-2024-7708高 7.5For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for…
• CVE-2026-1605高 7.5In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with …
• CVE-2024-8184中 6.5There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote…