CVE-2024-7708
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Summary
### Impact The original report: > Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state. After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak. ### Affected Versions * Jetty 11.0.0-11.0.22 (EOL) * Jetty 10.0.0-10.0.22 (EOL) ### Patched Versions * Jetty 11.0.23 * Jetty 10.0.23 ### Patches https://github.com/jetty/jetty.project/pull/12156 ### Workarounds No workarounds.
Affected packages
| Ecosystem | Package | Affected versions | Fixed versions |
|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | — | 10.0.23, 11.0.23 |
Remediation: Upgrade to 10.0.23 or later.
References
Includes data from the GitHub Advisory Database, licensed under CC-BY 4.0.
CVE® is a registered trademark of The MITRE Corporation. CVE content reproduced under the CVE Terms of Use; copyright designation © MITRE.
EPSS scores provided by the FIRST.org Exploit Prediction Scoring System.