Loading HuntDB...

GHSA-g8m5-722r-8whq

GitHub Security Advisory

Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

✓ GitHub Reviewed MODERATE Has CVE

Advisory Details

### Impact
Remote DOS attack can cause out of memory

### Description
There exists a security vulnerability in Jetty's `ThreadLimitHandler.getRemote()` which
can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By
repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the
server's memory.

### Affected Versions

* Jetty 12.0.0-12.0.8 (Supported)
* Jetty 11.0.0-11.0.23 (EOL)
* Jetty 10.0.0-10.0.23 (EOL)
* Jetty 9.3.12-9.4.55 (EOL)

### Patched Versions

* Jetty 12.0.9
* Jetty 11.0.24
* Jetty 10.0.24
* Jetty 9.4.56

### Workarounds

Do not use `ThreadLimitHandler`.
Consider use of `QoSHandler` instead to artificially limit resource utilization.

### References

Jetty 12 - https://github.com/jetty/jetty.project/pull/11723

Affected Packages

Maven org.eclipse.jetty:jetty-server
Affected versions: 12.0.0 (fixed in 12.0.9)
Maven org.eclipse.jetty:jetty-server
Affected versions: 10.0.0 (fixed in 10.0.24)
Maven org.eclipse.jetty:jetty-server
Affected versions: 11.0.0 (fixed in 11.0.24)
Maven org.eclipse.jetty:jetty-server
Affected versions: 9.3.12 (fixed in 9.4.56)

Related CVEs

Key Information

GHSA ID
GHSA-g8m5-722r-8whq
Published
October 14, 2024 9:08 PM
Last Modified
October 14, 2024 9:08 PM
CVSS Score
5.0 /10
Primary Ecosystem
Maven
Primary Package
org.eclipse.jetty:jetty-server
GitHub Reviewed
✓ Yes

Dataset

Last updated: July 7, 2025 6:28 AM

Data from GitHub Advisory Database. This information is provided for research and educational purposes.