Skip to content

CVE-2024-6762

CVE-2024-6762 · Jetty PushSessionCacheFilter can cause remote DoS attacks

This page contains facts from public vulnerability sources. Check the original advisory before updating.

Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.

CVSS 3.1 · Low · EPSS 0.9% · Fix available

Published: 2024-10-14T15:07:10.942Z
Updated: 2025-11-03T19:34:37.967Z

Stack: system

Affected products and versions

jetty
Versions
- ≥ 10.0.0, ≤ 10.0.17: Affected (semver)
- ≥ 11.0.0, ≤ 11.0.17: Affected (semver)
- ≥ 12.0.0, ≤ 12.0.3: Affected (semver)
No fix published
jetty9 Debian:12
Versions
- 9.4.50-4
- 9.4.50-4+deb12u1
- 9.4.50-4+deb12u2
- 9.4.50-4+deb12u3
- 9.4.51-1
- 9.4.51-2
- 9.4.52-1
- 9.4.53-1
- 9.4.54-1
- 9.4.55-1
- 9.4.56-1
Affected ranges
- ECOSYSTEM: < 9.4.57-0+deb12u1
Update to 9.4.57-0+deb12u1
jetty9 Debian:13
Affected ranges
- ECOSYSTEM: < 9.4.54-1
Update to 9.4.54-1
jetty9 Debian:14
Affected ranges
- ECOSYSTEM: < 9.4.54-1
Update to 9.4.54-1
jetty Ubuntu:14.04:LTS
Versions
- 6.1.26-1ubuntu1
- 6.1.26-1ubuntu1.1
- 6.1.26-1ubuntu1.2
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
jetty Ubuntu:16.04:LTS
Versions
- 6.1.26-5
- 6.1.26-5ubuntu0.1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
jetty9 Ubuntu:16.04:LTS
Versions
- 9.2.14-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
jetty9 Ubuntu:18.04:LTS
Versions
- 9.2.22-2
- 9.2.22-3
- 9.2.23-1
- 9.4.15-1~18.04.1ubuntu1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
jetty9 Ubuntu:20.04:LTS
Versions
- 9.4.18-2build2
- 9.4.26-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published
jetty9 Ubuntu:22.04:LTS
Versions
- 9.4.39-3
- 9.4.44-2
- 9.4.44-3
- 9.4.44-4
- 9.4.45-1
Affected ranges
- ECOSYSTEM: (−∞, +∞)
No fix published

Original sources

Check your server →