| Package | Affected versions | Patched versions |
|---|---|---|
| org.eclipse.jetty:jetty-server | ≥ 10.0.0, < 10.0.24≥ 11.0.0, < 11.0.24≥ 12.0.0, < 12.0.9≥ 9.3.12, < 9.4.56 | 10.0.2411.0.2412.0.99.4.56 |
| jetty | ≥ 10.0.0, < 10.0.24≥ 11.0.0, < 11.0.24≥ 12.0.0, < 12.0.9≥ 9.3.12, < 9.4.56 | 10.0.2411.0.2412.0.99.4.56 |
Remote DOS attack can cause out of memory
There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which
can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By
repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the
server's memory.
Do not use ThreadLimitHandler.
Consider use of QoSHandler instead to artificially limit resource utilization.
Jetty 12 - https://github.com/jetty/jetty.project/pull/11723
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free