GHSA-9299-c6m4-mjhc

Suggest an improvement
Source
https://github.com/advisories/GHSA-9299-c6m4-mjhc
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9299-c6m4-mjhc/GHSA-9299-c6m4-mjhc.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-9299-c6m4-mjhc
Aliases
Downstream
Published
2026-07-22T22:58:29Z
Modified
2026-07-22T23:25:41Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Details

Impact

The original report:

Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.

After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Affected Versions

  • Jetty 11.0.0-11.0.22 (EOL)
  • Jetty 10.0.0-10.0.22 (EOL)

Patched Versions

  • Jetty 11.0.23
  • Jetty 10.0.23

Patches

https://github.com/jetty/jetty.project/pull/12156

Workarounds

No workarounds.

Database specific 
{
    "cwe_ids":  [
        "CWE-400",
        "CWE-401"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-22T22:58:29Z",
    "nvd_published_at":  "2026-07-14T09:16:39Z",
    "severity":  "HIGH"
}
References

Affected packages

Maven / org.eclipse.jetty:jetty-server

Package

Name
org.eclipse.jetty:jetty-server
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
10.0.7
Fixed
10.0.23

Affected versions

10.*
10.0.7
10.0.8
10.0.9
10.0.10
10.0.11
10.0.12
10.0.13
10.0.14
10.0.15
10.0.16
10.0.17
10.0.18
10.0.19
10.0.20
10.0.21
10.0.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9299-c6m4-mjhc/GHSA-9299-c6m4-mjhc.json"

Maven / org.eclipse.jetty:jetty-server

Package

Name
org.eclipse.jetty:jetty-server
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
11.0.7
Fixed
11.0.23

Affected versions

11.*
11.0.7
11.0.8
11.0.9
11.0.10
11.0.11
11.0.12
11.0.13
11.0.14
11.0.15
11.0.16
11.0.17
11.0.18
11.0.19
11.0.20
11.0.21
11.0.22

Database specific

source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9299-c6m4-mjhc/GHSA-9299-c6m4-mjhc.json"