Technology · Maven

org.eclipse.jetty:jetty-server (Maven) vulnerabilities

Updated 9 November 2026, 03:07 UTC. Rebuilt every hour.

Junglewise Threat Intelligence has tracked 29 vulnerabilities in org.eclipse.jetty:jetty-server (Maven): 0 in the last 7 days and 0 in the last 90 days, 0 of them critical and 0 exploited in the wild. The most recent, CVE-2026-6790, was published on 14 July 2026.

Last 7 days: 0
Last 90 days: 0
Critical, all time: 0
Exploited in the wild: 0

About org.eclipse.jetty:jetty-server (Maven)

The core HTTP server component of the Eclipse Jetty project.

Homepage

Latest org.eclipse.jetty:jetty-server (Maven) vulnerabilities

CVE-2026-6790: Eclipse Jetty host authority and Host header mismatchmediumCVSS 5.3EPSS 0.3%14 Jul 2026
CVE-2026-10051: Eclipse Jetty information leakage via retained HTTP/1.1 trailersmediumCVSS 4EPSS 0.3%14 Jul 2026
CVE-2024-7708: Eclipse Jetty buffer leak in HttpConnectionhighCVSS 7.5EPSS 0.4%14 Jul 2026
CVE-2026-1605: Eclipse Jetty memory leak in GzipHandlerhighCVSS 7.5EPSS 0.7%5 Mar 2026
CVE-2024-13009: **UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate requestlowCVSS 3.1EPSS 0.5%8 May 2025
CVE-2024-8184: Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attackslowCVSS 3.1EPSS 1.0%14 Oct 2024
CVE-2023-26048: OutOfMemoryError for large multipart without filename in Eclipse JettylowCVSS 3.1EPSS 3.3%19 Apr 2023
CVE-2023-26049: Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookieslowCVSS 3.1EPSS 1.3%18 Apr 2023
CVE-2022-2191: Jetty SslConnection does not release pooled ByteBuffers in case of errorslowCVSS 3.1EPSS 2.2%7 Jul 2022
CVE-2011-4461: Improper Input Validation in JettylowCVSS 3EPSS 4.9%14 May 2022
CVE-2006-6969: Jetty Uses Predictable Session IdentifiersinfoEPSS 1.6%1 May 2022
CVE-2021-34428: SessionListener can prevent a session from being invalidated breaking logoutlowCVSS 3.1EPSS 1.0%23 Jun 2021
CVE-2021-28165: Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resourceslowCVSS 3.1EPSS 53.9%6 Apr 2021
CVE-2020-27223: DOS vulnerability for Quoted Quality CSV headerslowCVSS 3.1EPSS 78.0%10 Mar 2021
CVE-2020-27218: Buffer not correctly recycled in Gzip Request inflationlowCVSS 3.1EPSS 8.3%2 Dec 2020
CVE-2019-17638: Operation on a Resource after Expiration or Release in Jetty ServerlowCVSS 3.1EPSS 11.1%5 Aug 2020
CVE-2019-17632: Unescaped exception messages in error responses in JettylowCVSS 3.1EPSS 1.9%2 Dec 2019
CVE-2019-10246: Information Exposure vulnerability in Eclipse JettylowCVSS 3.1EPSS 4.1%23 Apr 2019
CVE-2019-10247: Installation information leak in Eclipse JettylowCVSS 3.1EPSS 5.9%23 Apr 2019
CVE-2019-10241: Cross-site Scripting in Eclipse JettylowCVSS 3EPSS 9.6%23 Apr 2019
CVE-2018-12545: Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-serverlowCVSS 3.1EPSS 5.1%28 Mar 2019
CVE-2015-2080: Jetty vulnerable to exposure of sensitive information to unauthenticated remote userslowCVSS 3EPSS 75.4%9 Nov 2018
CVE-2017-7658: Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)lowCVSS 3.1EPSS 19.4%19 Oct 2018
CVE-2017-7656: Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)lowCVSS 3EPSS 6.3%19 Oct 2018
CVE-2016-4800: Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted requestlowCVSS 3EPSS 6.4%19 Oct 2018

Most severe org.eclipse.jetty:jetty-server (Maven) vulnerabilities

Exploited in the wild first, then by severity and CVSS score.

CVE-2026-1605: Eclipse Jetty memory leak in GzipHandlerhighCVSS 7.5EPSS 0.7%5 Mar 2026
CVE-2024-7708: Eclipse Jetty buffer leak in HttpConnectionhighCVSS 7.5EPSS 0.4%14 Jul 2026
CVE-2026-6790: Eclipse Jetty host authority and Host header mismatchmediumCVSS 5.3EPSS 0.3%14 Jul 2026
CVE-2026-10051: Eclipse Jetty information leakage via retained HTTP/1.1 trailersmediumCVSS 4EPSS 0.3%14 Jul 2026
CVE-2020-27223: DOS vulnerability for Quoted Quality CSV headerslowCVSS 3.1EPSS 78.0%10 Mar 2021
CVE-2021-28165: Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resourceslowCVSS 3.1EPSS 53.9%6 Apr 2021
CVE-2017-7658: Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)lowCVSS 3.1EPSS 19.4%19 Oct 2018
CVE-2017-7657: Critical severity vulnerability that affects org.eclipse.jetty:jetty-serverlowCVSS 3.1EPSS 14.9%19 Oct 2018
CVE-2019-17638: Operation on a Resource after Expiration or Release in Jetty ServerlowCVSS 3.1EPSS 11.1%5 Aug 2020
CVE-2020-27218: Buffer not correctly recycled in Gzip Request inflationlowCVSS 3.1EPSS 8.3%2 Dec 2020

Vulnerabilities per week

Nothing was published in the last eight weeks. The last 13 weeks, by the week each vulnerability was published.

Vulnerabilities published per week, UTC
Week of	Bar	Vulns	Critical
17 Aug 2026		0	0
24 Aug 2026		0	0
31 Aug 2026		0	0
7 Sep 2026		0	0
14 Sep 2026		0	0
21 Sep 2026		0	0
28 Sep 2026		0	0
5 Oct 2026		0	0
12 Oct 2026		0	0
19 Oct 2026		0	0
26 Oct 2026		0	0
2 Nov 2026		0	0
9 Nov 2026		0	0

Embed a badge

A live badge for a README, a status page or an internal wiki: how many org.eclipse.jetty:jetty-server (Maven) vulnerabilities were published in the last 7 days and how many of them are critical, refreshed hourly.

[![org.eclipse.jetty:jetty-server (Maven) vulnerabilities](https://junglewise.ai/threats/technologies/org-eclipse-jetty-jetty-server/badge.svg)](https://junglewise.ai/threats/technologies/org-eclipse-jetty-jetty-server)

<a href="https://junglewise.ai/threats/technologies/org-eclipse-jetty-jetty-server"><img src="https://junglewise.ai/threats/technologies/org-eclipse-jetty-jetty-server/badge.svg" alt="org.eclipse.jetty:jetty-server (Maven) vulnerabilities" /></a>

How this is built

Junglewise Threat Intelligence collects vulnerabilities from NVD, GitHub Security Advisories, OSV, the CISA Known Exploited Vulnerabilities catalog, FIRST EPSS and vendor advisories, and matches each one to the technologies and vendors it affects. Dates are the date a vulnerability was published, in UTC.

The pages are rebuilt from the database every hour. Frozen weekly and monthly reports never change once published, so they can be cited.

Use this data

The same data is at https://junglewise.ai/threats/technologies/org-eclipse-jetty-jetty-server.json, and this page as text at https://junglewise.ai/threats/technologies/org-eclipse-jetty-jetty-server.md, for scripts and language models. It is free to reuse under CC BY 4.0 with a link back to this page.

Cite as: Junglewise Threat Intelligence, "org.eclipse.jetty:jetty-server (Maven) vulnerabilities", https://junglewise.ai/threats/technologies/org-eclipse-jetty-jetty-server, 9 November 2026.