Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

Description

References

• nvd.nist.gov/vuln/detail/CVE-2015-2080 · ADVISORY
• blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html · WEB
• GitHub Advisory GHSA-ghgj-3xqr-6jfm · ADVISORY
• eclipse/jetty.project · WEB
• security.netapp.com/advisory/ntap-20190307-0005 · WEB
• dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html · WEB
• dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html · WEB
• lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html · WEB
• packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html · WEB
• seclists.org/fulldisclosure/2015/Mar/12 · WEB

org.eclipse.jetty:jetty-server 的其他漏洞

• CVE-2026-6790中危 5.3In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what p…
• CVE-2026-10051高危 7.5In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the …
• CVE-2024-7708高危 7.5For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for…
• CVE-2026-1605高危 7.5In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with …
• CVE-2024-13009高危 7.2In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request bo…