| Package | Affected versions | Patched versions |
|---|---|---|
| org.eclipse.jetty:jetty-server | ≥ 10.0.7, < 10.0.23≥ 11.0.7, < 11.0.23 | 10.0.2311.0.23 |
| jetty | ≥ 10.0.7, < 10.0.23≥ 11.0.7, < 11.0.23 | 10.0.2311.0.23 |
The original report:
Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.
After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak.
https://github.com/jetty/jetty.project/pull/12156
No workarounds.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free