Description
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Metrics
CVSS 3.0 7.5/10
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NWeakness enumeration
Affected software
| Vendor | Product | Versions |
|---|---|---|
| n/a | n/a | n/a |
References
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.htmlVendor Advisory
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.htmlVendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.htmlThird Party Advisory
- http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.htmlExploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2015/Mar/12Exploit, Third Party Advisory
- http://www.securityfocus.com/archive/1/534755/100/1600/threaded
- http://www.securityfocus.com/bid/72768Broken Link
- http://www.securitytracker.com/id/1031800Third Party Advisory
- https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.htmlExploit, Third Party Advisory
- https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.mdExploit, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20190307-0005/
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.htmlVendor Advisory
- http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.htmlVendor Advisory
- http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.htmlThird Party Advisory
- http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.htmlExploit, Third Party Advisory
- http://seclists.org/fulldisclosure/2015/Mar/12Exploit, Third Party Advisory
- http://www.securityfocus.com/archive/1/534755/100/1600/threaded
- http://www.securityfocus.com/bid/72768Broken Link
- http://www.securitytracker.com/id/1031800Third Party Advisory
- https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.htmlExploit, Third Party Advisory
- https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.mdExploit, Vendor Advisory
- https://security.netapp.com/advisory/ntap-20190307-0005/
Timeline
- Published
- Oct 7, 2016
- Last modified
- Jun 17, 2026
- NVD status
- Modified