Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

中 6.5CVE-2024-8184 · GHSA-g8m5-722r-8whq · 14/10/2024 公開 · 17/06/2026 更新

要点

CVE-2024-8184 は org.eclipse.jetty:jetty-server, jetty (eclipse) に影響する深刻度「中」 (CVSS 6.5) の脆弱性です。
今後30日間に悪用される確率（EPSS）：1.0%（全脆弱性の 63.7% より高い）。
対処：10.0.24, 11.0.24, 12.0.9, 9.4.56 以降に更新してください。

パッケージ	影響を受けるバージョン	修正済みバージョン
org.eclipse.jetty:jetty-server Maven	`≥ 10.0.0, < 10.0.24≥ 11.0.0, < 11.0.24≥ 12.0.0, < 12.0.9≥ 9.3.12, < 9.4.56`	`10.0.2411.0.2412.0.99.4.56`
jetty eclipse	`≥ 10.0.0, < 10.0.24≥ 11.0.0, < 11.0.24≥ 12.0.0, < 12.0.9≥ 9.3.12, < 9.4.56`	`10.0.2411.0.2412.0.99.4.56`

概要

Impact

Remote DOS attack can cause out of memory

Description

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

Affected Versions

Jetty 12.0.0-12.0.8 (Supported)
Jetty 11.0.0-11.0.23 (EOL)
Jetty 10.0.0-10.0.23 (EOL)
Jetty 9.3.12-9.4.55 (EOL)

Patched Versions

Jetty 12.0.9
Jetty 11.0.24
Jetty 10.0.24
Jetty 9.4.56

Workarounds

Do not use ThreadLimitHandler.
Consider use of QoSHandler instead to artificially limit resource utilization.

References

Jetty 12 - https://github.com/jetty/jetty.project/pull/11723

NVD の説明

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.