GHSA-9299-c6m4-mjhc (CVE-2024-7708)

Details

Impact

The original report:

Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.

After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Affected Versions

Jetty 11.0.0-11.0.22 (EOL)
Jetty 10.0.0-10.0.22 (EOL)

Patched Versions

Jetty 11.0.23
Jetty 10.0.23

Patches

https://github.com/jetty/jetty.project/pull/12156

Workarounds

No workarounds.

Affected Packages

org.eclipse.jetty:jetty-server

Maven

Fixed in:

10.0.23

org.eclipse.jetty:jetty-server

Maven

Fixed in:

11.0.23

References

ADVISORY

https://github.com/advisories/GHSA-9299-c6m4-mjhc

PACKAGE

https://github.com/jetty/jetty.project

WEB

https://github.com/jetty/jetty.project/commit/8259eabbc70ae7fc2d525f1e95b43fbdfd2ad097

WEB

https://github.com/jetty/jetty.project/pull/12156

WEB

https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.23

WEB

https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.23

WEB

https://github.com/jetty/jetty.project/security/advisories/GHSA-9299-c6m4-mjhc

WEB

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29

ADVISORY

https://nvd.nist.gov/vuln/detail/CVE-2024-7708