{"kind": "product", "path": "vulns/debian-12/jetty9", "name": "jetty9", "product": "jetty9", "ecosystem": "Debian:12", "items": [{"id": "CVE-2026-18659", "noindex": false, "published": "2026-10-15T09:44:11.148Z", "modified": "2026-10-15T13:26:19.435Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00412, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18659", "title": "Unauthenticated authorization bypass in ConstraintSecurityHandler - HTTP method-omission matched by substring", "description": "In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, and `jetty-eeN-servlet`, the Jakarta Spec constraints defined as `http-method-omission` can be bypassed by using substrings of the defined HTTP Methods.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-53x7-f9fc-h7qr", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/214", "https://nvd.nist.gov/vuln/detail/CVE-2026-18659"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-18662", "noindex": false, "published": "2026-10-15T09:42:40.638Z", "modified": "2026-10-15T13:28:30.423Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00388, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18662", "title": "CVE-2026-18662", "description": "In Eclipse Jetty, across various versions of `jetty-security`, and `jetty-eeN-security`, two or more security constraints with the same http-method-omission set, and no url-patterns, are not combined properly per Jakarta Servlet Spec.\n\n\n\nResulting in later http-method-omission sets overriding previous constraints with the same http-method-omission set.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-phjh-v7c6-g7mv", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/210", "https://nvd.nist.gov/vuln/detail/CVE-2026-18662"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-19864", "noindex": false, "published": "2026-10-15T09:41:25.133Z", "modified": "2026-10-15T13:29:54.581Z", "cvss": 5.6, "cvss_vector": "CVSS:4.0/AV:L/AC:L/AT:P/PR:H/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00097, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19864", "title": "CVE-2026-19864", "description": "Eclipse Jetty's `SessionAuthentication` retains authentication credentials in a serializable object. When the credentials contain a plaintext password and the authenticated session is persisted to a session data store, the password may consequently be written to persistent storage in plaintext.\n\n\n\nAn attacker with sufficient privileges to read the persisted session data may obtain the plaintext passwords of authenticated users.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-q6wx-j9wr-fj7f", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/229", "https://nvd.nist.gov/vuln/detail/CVE-2026-19864"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-18660", "noindex": false, "published": "2026-10-15T09:38:02.125Z", "modified": "2026-10-15T13:32:37.345Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00315, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18660", "title": "Jetty proxy blacklist performs case-sensitive matching of case-insensitive DNS hostnames", "description": "In Eclipse Jetty, across various versions of `jetty-server`, and `jetty-proxy`, the host whitelist/blacklist is case-sensitive, and would allow hosts through that only differ by case.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-7wfj-j486-mxrf", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/212", "https://nvd.nist.gov/vuln/detail/CVE-2026-18660"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-18661", "noindex": false, "published": "2026-10-15T09:01:28.668Z", "modified": "2026-10-15T13:46:37.040Z", "cvss": 8.8, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00424, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-18661", "title": "CVE-2026-18661", "description": "In Eclipse Jetty, across various versions of `jetty-annotations`, and `jetty-eeN-annotations`, the Jakarta Spec authoritative url-pattern rules for mixed `@ServletSecurity` annotation, and `web.xml` defined `security-constraint` on the same `url-pattern` were not being applied if the `web.xml` had more than 1 `url-pattern` for a servlet, and had a `security-constraint` applying to only some of those `url-pattern` definitions.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-v6xf-996f-c35f", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/211", "https://nvd.nist.gov/vuln/detail/CVE-2026-18661"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-77711", "noindex": false, "published": "2026-10-15T08:51:48.066Z", "modified": "2026-10-15T13:50:52.566Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-77711", "title": "CVE-2026-77711", "description": "When Jetty's `HttpClient` make a request to a server through a forward proxy, the server may reply with a 407 (Proxy Authentication Required).\n\n\n\nThe client mistakenly interprets the 407 as coming from the proxy, so it re-sends the request with the `Proxy-Authentication` header, which arrives to the server, that now has access to the proxy credentials.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-r2c5-3p8g-wpvw", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/238", "https://nvd.nist.gov/vuln/detail/CVE-2026-77711"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-76184", "noindex": false, "published": "2026-10-15T08:46:54.683Z", "modified": "2026-10-15T13:51:45.344Z", "cvss": 8.2, "cvss_vector": "CVSS:4.0/AV:N/AC:H/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00388, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-76184", "title": "CVE-2026-76184", "description": "In Eclipse Jetty, HttpClient may receive a redirect of the form:\n\n\n\n```\n\n\n\n/secure/../evil\n\n\n\n```\n\n\n\nIf an attacker is able to control the redirects, then HttpClient matches authentication credentials against `/secure` rather than normalizing the path to `/evil`, and will therefore follow the redirect sending the `Authorization` header for `/secure` to `/evil`.\n\n\n\nThis also mean that the attacker must have an evil application deployed on the same domain as the target.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-qfr2-43g5-g768", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/236", "https://nvd.nist.gov/vuln/detail/CVE-2026-76184"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-76182", "noindex": false, "published": "2026-10-15T08:40:58.439Z", "modified": "2026-10-15T13:59:12.521Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:L/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00345, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-76182", "title": "CVE-2026-76182", "description": "In Eclipse Jetty, `TryPathsHandler` and `TryFilesFilter` can be configured to forward requests to template URIs such as `index?p=$path`, where `$path` is the request path in context.\n\n\n\nHowever, URI paths may contain characters that are reserved in URI queries so that a path of `/s&a=1` when applied to the template becomes `index?p=/s&a=1`, which is interpreted as 2 query parameters: `p=/s` and `a=1`, rather than just one query parameter `p` whose value is `/s&a=1`.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-4hxv-32vm-5h2m", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/237", "https://nvd.nist.gov/vuln/detail/CVE-2026-76182"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-12611", "noindex": false, "published": "2026-09-08T12:28:51.669Z", "modified": "2026-09-09T10:15:48.299Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00428, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-12611", "title": "CVE-2026-12611", "description": "A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive.\n\n\n\n\nThis is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client.\n\n\n\n\nThe race condition \"resets\" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3", "https://nvd.nist.gov/vuln/detail/CVE-2026-12611"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-19203", "noindex": false, "published": "2026-09-08T12:08:37.576Z", "modified": "2026-09-08T14:21:55.816Z", "cvss": 8.3, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00509, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-19203", "title": "CVE-2026-19203", "description": "A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling.\n\n\n\n\nThis is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h", "https://nvd.nist.gov/vuln/detail/CVE-2026-19203"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-10050", "noindex": false, "published": "2026-08-04T11:02:40.503Z", "modified": "2026-08-04T12:46:38.770Z", "cvss": 8.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "high", "epss": 0.00632, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-10050", "title": "Digest authentication lossy encoding", "description": "In Eclipse Jetty, the Digest authentication server-side component uses ISO-8859-1 to encode the password as bytes.\n\n\n\nThis was done because the initial specification for HTTP did not specify explicitly a charset, and it was assumed to be ISO-8859-1 for historical reasons.\n\n\n\nIf the password contains characters that cannot be represented in ISO-8859-1, they are silently replaced by `?`. This happens with passwords that contain Chinese, Cyrillic or Greek characters, for example: `αβ123` converts to `??123`.\n\n\n\nAn attacker can send a request with a digest `Authorization` header crafted with a password made of only `?` characters; the server woul", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-2fvj-hgj9-j2gr", "https://gitlab.eclipse.org/security/cve-assignment/-/work_items/120", "https://nvd.nist.gov/vuln/detail/CVE-2026-10050"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2024-7708", "noindex": false, "published": "2026-07-14T09:01:53.869Z", "modified": "2026-07-14T12:17:11.635Z", "cvss": 7.5, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H", "severity": "high", "epss": 0.0044, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2024-7708", "title": "CVE-2024-7708", "description": "For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.", "references": ["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29", "https://nvd.nist.gov/vuln/detail/CVE-2024-7708"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-8384", "noindex": false, "published": "2026-07-14T08:56:17.525Z", "modified": "2026-07-14T12:18:29.831Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.0033, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-8384", "title": "CVE-2026-8384", "description": "In Eclipse Jetty, an HTTP URI of this form:\n\n\n\n\n\n/public;/../admin/secret.txt\n\n\n\n\n\n\n\n\nresults in an unresolved path of:\n\n\n\n\n\n/public/../admin/secret.txt\n\n\n\n\n\n\n\n\ninstead of the expected:\n\n\n\n\n\n/admin/secret.txt\n\n\n\n\n\n\n\n\nJetty itself is not affected, as it will not serve the secret.txt file because it will not pass the alias checker (only resolved resources are served).\n\n\n\n\nHowever, web applications that rely on resolved paths being provided by Jetty may be confused when receiving an unresolved path.", "references": ["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/108", "https://nvd.nist.gov/vuln/detail/CVE-2026-8384"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-6790", "noindex": false, "published": "2026-07-14T08:51:30.527Z", "modified": "2026-07-14T12:20:35.130Z", "cvss": 5.3, "cvss_vector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "medium", "epss": 0.0031, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-6790", "title": "CVE-2026-6790", "description": "In Eclipse Jetty, for HTTP/1, HTTP/2 and HTTP/3 requests, there is no strict check that the request authority (host and port) matches what provided in the Host header (if present).\n\n\n\n\nThis was not enforced in earlier HTTP RFC (for example, in RFC 2616), but it is in the latest RFC (9110 and 9112).\n\n\n\n\nThis mismatch can cause a number of problems that may be classified as vulnerabilities such as:\n\n\n\n  *  \n        \n      URI constructions (for example, for redirects -- this is typical for login pages)\n\n  *  \n        \n      Virtual host selection\n\n  *  \n        \n      Reverse proxying\n\n  *  \n        \n      Misleading logs\n\n  *  \n        \n      ", "references": ["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/99", "https://nvd.nist.gov/vuln/detail/CVE-2026-6790"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-10051", "noindex": false, "published": "2026-07-14T08:44:38.233Z", "modified": "2026-07-14T12:57:50.096Z", "cvss": 6.9, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N", "severity": "medium", "epss": 0.00429, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-10051", "title": "CVE-2026-10051", "description": "In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.\nSubsequent request that do not have trailers report the trailers of the first request.\nSubsequent request that do have trailers report the union of trailers of the first request and the current request.", "references": ["https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119", "https://nvd.nist.gov/vuln/detail/CVE-2026-10051"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-2332", "noindex": false, "published": "2026-04-14T10:59:10.193Z", "modified": "2026-09-14T12:04:28.913Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.01305, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-2332", "title": "HTTP Request Smuggling via Chunked Extension Quoted-String Parsing", "description": "In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the \"funky chunks\" techniques outlined here:\n  *  https://w4ke.info/2025/06/18/funky-chunks.html\n\n  *  https://w4ke.info/2025/10/29/funky-chunks-2.html\n\n\nJetty terminates chunk extension parsing at \\r\\n inside quoted strings instead of treating this as an error.\n\n\n\n\nPOST / HTTP/1.1\nHost: localhost\nTransfer-Encoding: chunked\n\n1;ext=\"val\nX\n0\n\nGET /smuggled HTTP/1.1\n...\n\n\n\n\n\nNote how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf", "https://gitlab.eclipse.org/security/cve-assignment/-/issues/89", "https://access.redhat.com/security/cve/CVE-2026-2332"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2026-5795", "noindex": false, "published": "2026-04-08T13:32:28.935Z", "modified": "2026-09-14T12:04:27.326Z", "cvss": 7.4, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:N", "severity": "high", "epss": 0.00529, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2026-5795", "title": "CVE-2026-5795", "description": "In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable.\n\n\nUpon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals.\n\n\nA subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-r7p8-xq5m-436chttps://", "https://gitlab.eclipse.org/security/cve-assignment/-/issues/92", "https://access.redhat.com/security/cve/CVE-2026-5795"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2025-11143", "noindex": false, "published": "2026-03-05T09:26:59.830Z", "modified": "2026-03-05T14:48:41.622Z", "cvss": 3.7, "cvss_vector": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N", "severity": "low", "epss": 0.00165, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-11143", "title": "CVE-2025-11143", "description": "The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-wjpw-4j6x-6rwh", "https://nvd.nist.gov/vuln/detail/CVE-2025-11143"], "fixes": [], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "DSA-6005-1", "noindex": false, "published": "2025-09-19T00:00:00Z", "modified": "2026-03-09T02:11:08.272097Z", "cvss": null, "cvss_vector": "", "severity": "unknown", "epss": null, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/dsa-6005-1", "title": "jetty9 - security update", "description": "jetty9 - security update", "references": ["https://osv.dev/vulnerability/DSA-6005-1"], "fixes": ["9.4.57-1.1~deb12u1"], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}, {"id": "CVE-2025-5115", "noindex": false, "published": "2025-08-20T19:07:11.546Z", "modified": "2025-11-04T21:11:37.182Z", "cvss": 7.7, "cvss_vector": "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H", "severity": "high", "epss": 0.03566, "kev": false, "exploits": [], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}], "path": "vulns/cve-2025-5115", "title": "MadeYouReset HTTP/2 vulnerability", "description": "In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.\n\n\nFor example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal.\nPer specification  https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame.\nThe client can now open another stream and send another bad W", "references": ["https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h", "https://github.com/jetty/jetty.project/pull/13449", "https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.0"], "fixes": ["9.4.57-1.1~deb12u1"], "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}]}], "total": 57, "unknown_count": 0, "release_unconfirmed": false, "page": 1, "pages": 3, "filtered": false, "noindex": false, "filters": {}, "page_size": 20, "products": [{"name": "jetty9", "path": "vulns/debian-12/jetty9", "ecosystem": "Debian:12"}], "stacks": [{"name": "system", "path": "vulns/stack/system", "slug": "system"}, {"name": "web", "path": "vulns/stack/web", "slug": "web"}, {"name": "php", "path": "vulns/stack/php", "slug": "php"}, {"name": "python", "path": "vulns/stack/python", "slug": "python"}, {"name": "node", "path": "vulns/stack/node", "slug": "node"}, {"name": "database", "path": "vulns/stack/database", "slug": "database"}, {"name": "containers", "path": "vulns/stack/containers", "slug": "containers"}, {"name": "network", "path": "vulns/stack/network", "slug": "network"}, {"name": "applications", "path": "vulns/stack/applications", "slug": "applications"}], "versions": [], "stats": {"recent": 8, "kev": 0}, "lastmod": "2026-10-15T13:59:12.521Z", "early_advisories": [], "license": "Подборку PatchFirst и наши дополнения (приоритеты, ранние предупреждения, тексты, сводки и агрегаты) можно свободно использовать для собственных целей, включая внутренние задачи бизнеса. Перепродажа, коммерческое распространение и массовое зеркалирование этой подборки или дополнений допускаются только по письменному соглашению с оператором. При любом использовании или публикации подборки или наших дополнений указывайте PatchFirst (https://ru.patchfirst.dev/vulns/) с этой ссылкой на страницу ленты своего региона. Исходные записи открытых источников остаются под их лицензиями и условиями. Эти условия не ограничивают ваши права на исходные данные, которые можно получить у источников напрямую.", "terms_url": "https://ru.patchfirst.dev/vulns/#feed-terms", "attribution": {"name": "PatchFirst", "url": "https://ru.patchfirst.dev/vulns/"}, "source_changes": "PatchFirst отбирает, нормализует и объединяет записи; могут добавляться сводки и переводы. Новости указываются ссылкой на первоисточник в самой записи.", "sources": [{"id": "cve", "name": "CVE List / CVE.org", "url": "https://www.cve.org/", "license": "CVE Terms of Use", "terms_url": "https://www.cve.org/Legal/TermsOfUse", "notice": "Copyright © 1999–2021, The MITRE Corporation. LICENSE Submissions : For all materials you submit to the Common Vulnerabilities and Exposures (CVE™), you hereby grant to The MITRE Corporation (MITRE) and all CVE Numbering Authorities (CNAs) a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute such materials and derivative works. Unless required by applicable law or agreed to in writing, you provide such materials on an \"AS IS\" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied, including, without limitation, any warranties or conditions of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A PARTICULAR PURPOSE. CVE Usage : MITRE hereby grants you a perpetual, worldwide, non-exclusive, no-charge, royalty-free, irrevocable copyright license to reproduce, prepare derivative works of, publicly display, publicly perform, sublicense, and distribute Common Vulnerabilities and Exposures (CVE™). Any copy you make for such purposes is authorized provided that you reproduce MITRE's copyright designation and this license in any such copy. DISCLAIMERS ALL DOCUMENTS AND THE INFORMATION CONTAINED THEREIN PROVIDED BY MITRE ARE PROVIDED ON AN \"AS IS\" BASIS AND THE CONTRIBUTOR, THE ORGANIZATION HE/SHE REPRESENTS OR IS SPONSORED BY (IF ANY), THE MITRE CORPORATION, ITS BOARD OF TRUSTEES, OFFICERS, AGENTS, AND EMPLOYEES, DISCLAIM ALL WARRANTIES, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY THAT THE USE OF THE INFORMATION THEREIN WILL NOT INFRINGE ANY RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE."}, {"id": "osv", "name": "OSV", "url": "https://osv.dev/", "terms_url": "https://google.github.io/osv.dev/data/", "terms": "Лицензии исходных баз различаются; см. каталог источников."}, {"id": "kev", "name": "CISA KEV", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "license": "CC0-1.0", "terms_url": "https://github.com/cisagov/kev-data/blob/develop/LICENSE"}, {"id": "epss", "name": "FIRST EPSS", "url": "https://www.first.org/epss/", "terms_url": "https://www.first.org/epss/faq", "terms": "Оценки доступны свободно; запрашивается указание источника (FIRST EPSS, оценки подготовлены Empirical Security)."}, {"id": "github-advisory", "name": "GitHub Advisory Database", "url": "https://github.com/advisories", "license": "CC-BY-4.0", "terms_url": "https://github.com/github/advisory-database/blob/main/LICENSE.md"}, {"id": "exploitdb", "name": "Exploit-DB", "url": "https://www.exploit-db.com/", "license": "GPL-2.0", "terms_url": "https://gitlab.com/exploit-database/exploitdb/-/blob/main/LICENSE.md"}, {"id": "metasploit", "name": "Metasploit", "url": "https://github.com/rapid7/metasploit-framework", "license": "BSD-3-Clause", "terms_url": "https://github.com/rapid7/metasploit-framework/blob/master/LICENSE", "notice": "Copyright (c) 2006-2026, Rapid7, Inc.\nLicense: BSD-3-clause\n Redistribution and use in source and binary forms, with or without modification,\n are permitted provided that the following conditions are met:\n .\n * Redistributions of source code must retain the above copyright notice,\n this list of conditions and the following disclaimer.\n .\n * Redistributions in binary form must reproduce the above copyright notice,\n this list of conditions and the following disclaimer in the documentation\n and/or other materials provided with the distribution.\n .\n * Neither the name of Rapid7, Inc. nor the names of its contributors\n may be used to endorse or promote products derived from this software\n without specific prior written permission.\n .\n THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS \"AS IS\" AND\n ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED\n WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE\n DISCLAIMED. IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR\n ANY DIRECT, INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES\n (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES;\n LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON\n ANY THEORY OF LIABILITY, WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT\n (INCLUDING NEGLIGENCE OR OTHERWISE) ARISING IN ANY WAY OUT OF THE USE OF THIS\n SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGE."}, {"id": "nuclei", "name": "Nuclei Templates", "url": "https://github.com/projectdiscovery/nuclei-templates", "license": "MIT", "terms_url": "https://github.com/projectdiscovery/nuclei-templates/blob/main/LICENSE.md", "notice": "MIT License\n\nCopyright (c) 2025 ProjectDiscovery, Inc.\n\nPermission is hereby granted, free of charge, to any person obtaining a copy\nof this software and associated documentation files (the \"Software\"), to deal\nin the Software without restriction, including without limitation the rights\nto use, copy, modify, merge, publish, distribute, sublicense, and/or sell\ncopies of the Software, and to permit persons to whom the Software is\nfurnished to do so, subject to the following conditions:\n\nThe above copyright notice and this permission notice shall be included in all\ncopies or substantial portions of the Software.\n\nTHE SOFTWARE IS PROVIDED \"AS IS\", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR\nIMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,\nFITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE\nAUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER\nLIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,\nOUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE\nSOFTWARE."}, {"id": "linux-kernel", "name": "Linux kernel releases", "url": "https://www.kernel.org/", "license": "CC-BY-SA-4.0", "terms_url": "https://www.kernel.org/legal.html", "notice": "Copyright (C) 1997-2014 by The Linux Kernel Organization, Inc."}]}