GHSA-9299-c6m4-mjhc Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

• Maven org.eclipse.jetty:jetty-server: >= 10.0.7, < 10.0.23 → fixed in 10.0.23 • Maven org.eclipse.jetty:jetty-server: >= 11.0.7, < 11.0.23 → fixed in 11.0.23

Impact The original report: > Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state. After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak. Affected Versions • Jetty 11.0.0-11.0.22 (EOL) • Jetty 10.0.0-10.0.22 (EOL) Patched Versions • Jetty 11.0.23 • Jetty 10.0.23 Patches https://github.com/jetty/jetty.project/pull/12156 Workarounds No workarounds.