VDB

GHSA-j26w-f9rq-mr2q

GHSA-j26w-f9rq-mr2q PUBLISHED CVSS 5.300000190734863 MEDIUM

Eclipse Jetty has a denial of service vulnerability on DosFilter

Record from GitHub Advisory Database · Published October 14, 2024

jetty-ee8-servlets is fixed in 12.0.3 (Maven Central)

Eclipse Jetty has a denial of service vulnerability on DosFilter

Fixed versions

Upgrade to a fixed version or later. Language registries are listed first, then Linux distributions, then vendor products.

PackageEcosystemFixed in
org.eclipse.jetty.ee8:jetty-ee8-servletsMaven Central12.0.3
org.eclipse.jetty.ee10:jetty-ee10-servletsMaven Central12.0.3
org.eclipse.jetty.ee9:jetty-ee9-servletsMaven Central12.0.3
org.eclipse.jetty:jetty-servletsMaven Central11.0.18, 10.0.18, 9.4.54
spark-3.5Chainguard3.5.7-r2
cassandra-reaperChainguard4.0.1-r1
cassandra-reaperWolfi4.0.1-r1
apache-hopChainguard2.15.0-r2
spark-fips-3.5Chainguard3.5.8-r3
cassandra-reaper-jre-bcfipsChainguard3.7.1-r1
apache-hop-fipsChainguard2.15.0-r2

Risk scores

CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Affected products

VendorProductVersions
chainguardspark-3.50
chainguardcassandra-reaper0
wolficassandra-reaper0
chainguardapache-hop0
Mavenorg.eclipse.jetty.ee8:jetty-ee8-servlets12.0.0
Mavenorg.eclipse.jetty.ee9:jetty-ee9-servlets12.0.0
Mavenorg.eclipse.jetty.ee10:jetty-ee10-servlets12.0.0
chainguardspark-fips-3.50
chainguardcassandra-reaper-jre-bcfips0
Mavenorg.eclipse.jetty:jetty-servlets9.0.0, 11.0.0, 10.0.0
chainguardapache-hop-fips0

Timeline

  • Oct 14, 2024 CVE Published
  • Apr 9, 2026 Security Advisory

Query this with the API

The same record, from the CLI:

vulnetix vdb vuln GHSA-j26w-f9rq-mr2q
vulnetix vdb fixes GHSA-j26w-f9rq-mr2q

Or with curl, using the org id and key from your account page:

curl -s -H "Authorization: ApiKey ${VULNETIX_ORG_ID}:${VULNETIX_API_KEY}" \
  "https://api.vdb.vulnetix.com/v2/vuln/GHSA-j26w-f9rq-mr2q/fixes/registry"

The Community plan is free and allows 50 queries a day. Get a free API key · API quickstart

References

Look up in the Resolve Platform →
$ Lookup Community · 50/day Open Lookup ›