Product by Eclipse Foundation
Jetty
25 known vulnerabilities in Jetty (Eclipse Foundation), 0 of them actively exploited (CISA KEV).
Key figures
25
Vulnerabilities
0
Actively exploited (KEV)
0
Used by ransomware
2
Critical
Vulnerabilities
Actively exploited vulnerabilities (CISA KEV) first, then by priority. Click a column header to re-sort the table.
| Critical | CVE-2026-2332 | HTTP Request Smuggling via Chunked Extension Quoted-String Parsing | 9.1 | |
| Critical | CVE-2026-10050 | Digest authentication lossy encoding | 9.1 | |
| High | CVE-2026-19203 | Eclipse Jetty: HTTP Request/Response Smuggling | — | |
| High | CVE-2026-18661 | Eclipse Foundation Org.eclipse.jetty.ee11:jetty-ee11-annotations: Incorrect Authorization | — | |
| High | CVE-2026-1605 | Eclipse Jetty: Missing Release of Memory after Effective Lifetime | 7.5 | |
| High | CVE-2026-77711 | Eclipse Jetty: Exposure of Sensitive Information to an Unauthorized Actor | — | |
| High | CVE-2026-19204 | Eclipse Jetty: Memory Allocation with Excessive Size Value | — | |
| High | CVE-2026-5795 | Eclipse Jetty: Sensitive Information in Resource Not Removed Before Reuse | 7.4 | |
| High | CVE-2026-76184 | Eclipse Jetty: Exposure of Sensitive Information to an Unauthorized Actor | — | |
| High | CVE-2026-18660 | Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames | — | |
| Medium | CVE-2026-18659 | Eclipse Foundation Org.eclipse.jetty.ee11:jetty-ee11-servlet: Incorrect Authorization | — | |
| Medium | CVE-2026-18662 | Eclipse Foundation Org.eclipse.jetty.ee11:jetty-ee11-servlet: Incorrect Authorization | — | |
| High | CVE-2025-1948 | Eclipse Jetty HTTP clients can increase memory allocation | 7.5 | |
| Medium | CVE-2026-76182 | Eclipse Jetty: Injection | — | |
| High | CVE-2024-7708 | Eclipse Jetty: Missing Release of Memory after Effective Lifetime | 7.5 | |
| High | CVE-2026-10051 | Eclipse Jetty: Exposure of Sensitive Information to an Unauthorized Actor | 7.5 | |
| Medium | CVE-2024-8184 | Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks | 5.9 | |
| High | CVE-2024-9823 | Jetty DOS vulnerability on DosFilter | 5.3 | |
| High | CVE-2024-13009 | Eclipse Jetty GZIP buffer release | 7.2 | |
| Medium | CVE-2026-19864 | Eclipse Foundation Org.eclipse.jetty:jetty-security: Cleartext Storage of Sensitive Information | — | |
| Medium | CVE-2024-6763 | Jetty URI parsing of invalid authority | 3.7 | |
| Medium | CVE-2026-8384 | Eclipse Jetty: Use of Non-Canonical URL Paths for Authorization Decisions | 5.3 | |
| Medium | CVE-2026-6790 | Eclipse Jetty: Improper Input Validation | 5.3 | |
| Medium | CVE-2024-6762 | Jetty PushSessionCacheFilter can cause remote DoS attacks | 3.1 | |
| Medium | CVE-2025-11143 | Eclipse Jetty: Improper Input Validation | 3.7 |
News
- NCSC-2026-0377 [1.00] [M/H] Kwetsbaarheden verholpen in Oracle Enterprise Managerncsc-nl,
- @RISK®: The Consensus Security Vulnerability Alert: Vol. 26, Num. 31sans-atrisk-mail,
- Oracle’s July update fixes ten 10.0 vulnerabilities in Fusion Middlewarecsoonline,
- Oracle’s first monthly patch release fixes 35 flaws, including 11 rated ‘critical’csoonline,