{"kind": "product", "path": "vulns/ubuntu-16.04-lts/jetty", "name": "jetty", "product": "jetty", "ecosystem": "Ubuntu:16.04:LTS", "items": [{"id": "CVE-2026-18661", "noindex": false, "published": "2026-10-15T09:01:28.668Z", "modified": "2026-10-15T13:46:37.040Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00424, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18661", "title": "CVE-2026-18661", "description": "In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-v6xf-996f-c35f", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/211", "https://nvd.nist.gov/vuln/detail/CVE-2026-18661"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-77711", "noindex": false, "published": "2026-10-15T08:51:48.066Z", "modified": "2026-10-15T13:50:52.566Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-77711", "title": "CVE-2026-77711", "description": "When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).\n\n\n\nThe client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/238", "https://nvd.nist.gov/vuln/detail/CVE-2026-77711"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-76184", "noindex": false, "published": "2026-10-15T08:46:54.683Z", "modified": "2026-10-15T13:51:45.344Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00388, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-76184", "title": "CVE-2026-76184", "description": "In Eclipse Jetty, HttpClient may receive a redirect of the form:\n\n\n\n```\n\n\n\n/secure/../evil\n\n\n\n```\n\n\n\nIf an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.\n\n\n\nThis also mean that the attacker must have an evil application deployed on the same domain as the target.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/236", "https://nvd.nist.gov/vuln/detail/CVE-2026-76184"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-76182", "noindex": false, "published": "2026-10-15T08:40:58.439Z", "modified": "2026-10-15T13:59:12.521Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00345, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-76182", "title": "CVE-2026-76182", "description": "In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.\n\n\n\nHowever, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/237", "https://nvd.nist.gov/vuln/detail/CVE-2026-76182"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-19203", "noindex": false, "published": "2026-09-08T12:08:37.576Z", "modified": "2026-09-08T14:21:55.816Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00509, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19203", "title": "CVE-2026-19203", "description": "A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.\n\n\n\n\nThis is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h", "https://nvd.nist.gov/vuln/detail/CVE-2026-19203"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2026-5795", "noindex": false, "published": "2026-04-08T13:32:28.935Z", "modified": "2026-09-14T12:04:27.326Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00529, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-5795", "title": "CVE-2026-5795", "description": "In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps://", "https://gitlab.eclipse.org/security/cve-assignment/-/issues/92", "https://access.redhat.com/security/cve/CVE-2026-5795"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2025-5115", "noindex": false, "published": "2025-08-20T19:07:11.546Z", "modified": "2025-11-04T21:11:37.182Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.03566, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-5115", "title": "MadeYouReset HTTP/2 vulnerability", "description": "In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.\n\n\nFor example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal.\nPer specification  https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame.\nThe client can now open another stream and send another bad W", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h", "https://github.com/jetty/jetty.project/pull/13449", "https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.0"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2025-1948", "noindex": false, "published": "2025-05-08T17:48:40.831Z", "modified": "2025-05-08T18:31:44.196Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.00781, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-1948", "title": "Eclipse Jetty HTTP clients can increase memory allocation", "description": "In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.\nThe Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.", "references": ["https://gitlab.eclipse.org/security/cve-assignement/-/issues/56", "https://github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8", "https://nvd.nist.gov/vuln/detail/CVE-2025-1948"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2024-8184", "noindex": false, "published": "2024-10-14T15:09:37.861Z", "modified": "2025-11-03T19:34:56.811Z", "cvss": 5.9, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "medium", "epss": 0.0103, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-8184", "title": "Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks", "description": "There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack.  By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq", "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30", "https://github.com/jetty/jetty.project/pull/11723"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2024-6762", "noindex": false, "published": "2024-10-14T15:07:10.942Z", "modified": "2025-11-03T19:34:37.967Z", "cvss": 3.1, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L", "severity": "low", "epss": 0.00942, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-6762", "title": "Jetty  PushSessionCacheFilter can cause remote DoS attacks", "description": "Jetty PushSessionCacheFilter can be exploited by unauthenticated users \nto launch remote DoS attacks by exhausting the server’s memory.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-r7m4-f9h5-gr79", "https://gitlab.eclipse.org/security/cve-assignement/-/issues/24", "https://github.com/jetty/jetty.project/pull/9715"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2024-6763", "noindex": false, "published": "2024-10-14T15:06:07.298Z", "modified": "2025-03-07T00:10:46.301Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00965, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-6763", "title": "Jetty URI parsing of invalid authority", "description": "Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.\n\nThe HttpURI class does insufficient validation on the authority segment of a URI.  However the behaviour of HttpURI\n differs from the common browsers in how it handles a URI that would be \nconsidered invalid if fully validated against the RRC.  Specifically HttpURI\n and the browser may differ on the value of the host extracted from an \ninvalid URI and thus a combination of Jetty and a vulnerable browser may\n be vulnerable to a open redirect attack or to a SSRF attack if the URI \nis used after ", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxh", "https://gitlab.eclipse.org/security/cve-assignement/-/issues/25", "https://github.com/jetty/jetty.project/pull/12012"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2024-9823", "noindex": false, "published": "2024-10-14T15:03:02.293Z", "modified": "2025-11-03T19:35:02.369Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.0094, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-9823", "title": "Jetty DOS vulnerability on DosFilter", "description": "There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h", "https://gitlab.eclipse.org/security/cve-assignement/-/issues/39", "https://github.com/jetty/jetty.project/issues/1256"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2024-22201", "noindex": false, "published": "2024-02-26T16:13:33.848Z", "modified": "2025-02-13T17:33:34.951Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.01433, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-22201", "title": "Jetty connection leaking on idle timeout when TCP congested", "description": "Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98", "https://github.com/jetty/jetty.project/issues/11256", "https://security.netapp.com/advisory/ntap-20240329-0001/"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2023-36478", "noindex": false, "published": "2023-10-10T16:53:07.063Z", "modified": "2025-02-13T16:56:19.080Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.04832, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-36478", "title": "HTTP/2 HPACK integer overflow and buffer allocation", "description": "Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to\nexceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295\nwill overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuil", "references": ["https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r", "https://github.com/eclipse/jetty.project/pull/9634", "https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2023-36479", "noindex": false, "published": "2023-09-15T18:37:35.948Z", "modified": "2025-06-18T14:41:11.113Z", "cvss": 3.5, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:N/I:L/A:N", "severity": "low", "epss": 0.01162, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-36479", "title": "Jetty vulnerable to errant command quoting in CGI Servlet", "description": "Eclipse Jetty Canonical Repository is the canonical repository for the Jetty project. Users of the CgiServlet with a very specific command structure may have the wrong command executed. If a user sends a request to a org.eclipse.jetty.servlets.CGI Servlet for a binary with a space in its name, the servlet will escape the command by wrapping it in quotation marks. This wrapped command, plus an optional command prefix, will then be executed through a call to Runtime.exec. If the original binary name provided by the user contains a quotation mark followed by a space, the resulting command line will contain multiple tokens instead of one. This is", "references": ["https://github.com/eclipse/jetty.project/security/advisories/GHSA-3gh6-v5v9-6v9j", "https://github.com/eclipse/jetty.project/pull/9516", "https://github.com/eclipse/jetty.project/pull/9888"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2023-26049", "noindex": false, "published": "2023-04-18T20:35:36.506Z", "modified": "2025-02-13T16:44:44.710Z", "cvss": 2.4, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:R/S:U/C:L/I:N/A:N", "severity": "low", "epss": 0.013, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-26049", "title": "Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty", "description": "Jetty is a java based web server and servlet engine. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies, or otherwise perform unintended behavior by tampering with the cookie parsing mechanism. If Jetty sees a cookie VALUE that starts with `\"` (double quote), it will continue to read the cookie string until it sees a closing quote -- even if a semicolon is encountered. So, a cookie header such as: `DISPLAY_LANGUAGE=\"b; JSESSIONID=1337; c=d\"` will be parsed as one cookie, with the name DISPLAY_LANGUAGE and a value of b; JSESSIONID=1337; c=d instead of 3 separate cookies. This has security implicat", "references": ["https://github.com/eclipse/jetty.project/security/advisories/GHSA-p26g-97m4-6q7c", "https://github.com/eclipse/jetty.project/pull/9339", "https://github.com/eclipse/jetty.project/pull/9352"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2023-26048", "noindex": false, "published": "2023-04-18T20:30:20.420Z", "modified": "2025-02-13T16:44:44.177Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L", "severity": "medium", "epss": 0.03369, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2023-26048", "title": "OutOfMemoryError for large multipart without filename in Eclipse Jetty", "description": "Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutO", "references": ["https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8", "https://github.com/eclipse/jetty.project/issues/9076", "https://github.com/eclipse/jetty.project/pull/9344"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2022-2191", "noindex": false, "published": "2022-07-07T20:45:16.000Z", "modified": "2024-08-03T00:32:08.749Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.02178, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-2191", "title": "CVE-2022-2191", "description": "In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.", "references": ["https://github.com/eclipse/jetty.project/security/advisories/GHSA-8mpp-f3f7-xc28", "https://security.netapp.com/advisory/ntap-20220909-0003/", "https://nvd.nist.gov/vuln/detail/CVE-2022-2191"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2022-2047", "noindex": false, "published": "2022-07-07T20:45:12.000Z", "modified": "2024-08-03T00:24:44.138Z", "cvss": 2.7, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.01324, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-2047", "title": "CVE-2022-2047", "description": "In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.", "references": ["https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q", "https://www.debian.org/security/2022/dsa-5198", "https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}, {"id": "CVE-2022-2048", "noindex": false, "published": "2022-07-07T20:35:09.000Z", "modified": "2024-08-03T00:24:43.964Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.02562, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2022-2048", "title": "CVE-2022-2048", "description": "In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.", "references": ["https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j", "https://www.debian.org/security/2022/dsa-5198", "https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html"], "fixes": [], "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}]}], "total": 28, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 2, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "jetty", "path": "vulns/ubuntu-16.04-lts/jetty", "ecosystem": "Ubuntu:16.04:LTS"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 4, "kev": 0}, "lastmod": "2026-10-15T13:59:12.521Z", "early_advisories": [], "license": "Sie dürfen die Auswahl von PatchFirst und unsere Ergänzungen (Prioritäten, Frühwarnungen, Texte, Zusammenfassungen und Aggregate) für eigene Zwecke einschließlich interner geschäftlicher Aufgaben frei nutzen. Weiterverkauf, kommerzielle Verbreitung und massenhafte Spiegelung dieser Auswahl oder Ergänzungen erfordern eine schriftliche Vereinbarung mit dem Betreiber. Nennen Sie bei jeder Nutzung oder Veröffentlichung der Auswahl oder unserer Ergänzungen PatchFirst (https://patchfirst.dev/vulns/) mit diesem Link zur Feedseite Ihrer Region als Quelle. Originaleinträge aus offenen Quellen unterliegen weiterhin ihren jeweiligen Lizenzen und Bedingungen. Diese Bedingungen beschränken Ihre Rechte an den Originaldaten nicht, die Sie direkt bei den Quellen beziehen können.", "terms_url": "https://patchfirst.dev/de/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://patchfirst.dev/vulns/"}, "source_changes": "PatchFirst wählt Einträge aus, normalisiert und kombiniert sie; Zusammenfassungen und Übersetzungen können hinzukommen. Nachrichten werden im jeweiligen Eintrag mit einem Link zur Originalquelle belegt.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Die Lizenzen der Ursprungsdatenbanken unterscheiden sich; siehe Quellenkatalog."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Frei zugängliche Bewertungen; Quellenangabe erbeten (FIRST EPSS, Bewertungen von Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}