GitHub Advisoryadvisory · Maven

GHSA-h2f4-v4c4-6wx4 Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

HIGH Published 2019-03-28 Modified 2026-03-30 Official page ↗
Aliases
CVE-2018-12545
Ecosystem
Maven
Packages
org.eclipse.jetty:jetty-server
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2020-06-16

Affected packages

• Maven org.eclipse.jetty:jetty-server: >= 9.4.0, < 9.4.12.v20180830 → fixed in 9.4.12.v20180830 • Maven org.eclipse.jetty:jetty-server: >= 9.3.0, < 9.3.25.v20180904 → fixed in 9.3.25.v20180904

Description

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

Related

Alias · CVE (1)

  • CVE-2018-12545 In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References