In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.
{
"versions": [
{
"introduced": "0"
},
{
"last_affected": "9.3.0-20150601"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.0-20150608"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.0-20150612"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.0-maintenance0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.0-maintenance1"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.0-maintenance2"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.0-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.0-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.1-20150714"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.2-20150730"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.3-20150825"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.3-20150827"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.4-20151005"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.4-20151007"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.4-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.4-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.5-20151012"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.6-20151106"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.7-20160115"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.7-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.7-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.8-20160311"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.8-20160314"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.8-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.9-20160517"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.9-maintenance_0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.9-maintenance_1"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.10-20160621"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.10-maintenance_0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.11-20160721"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.11-maintenance_0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.12-20160915"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.13-20161014"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.13-maintenance_0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.14-20161028"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.15-20161220"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.16-20170119"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.16-20170120"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.17-20170317"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.17-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.18-20170406"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.19-20170502"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.20-20170531"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.21-20170918"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.21-maintenance_0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.21-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.22-20171030"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.23-20180228"
},
{
"introduced": "0"
},
{
"last_affected": "9.3.24-20180605"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.0-20161207"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.0-20161208"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.0-20180619"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.0-maintenance_0"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.0-maintenance_1"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.0-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.0-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.0-rc2"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.0-rc3"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.1-20170120"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.1-20180619"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.2-20170220"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.2-20180619"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.3-20170317"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.3-20180619"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.4-20170410"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.4-20170414"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.4-20180619"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.5-20170502"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.5-20180619"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.6-20170531"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.6-20180619"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.7-20170914"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.7-20180619"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.7-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.8-20171121"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.8-20180619"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.9-20180320"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.10-20180503"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.10-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.10-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.11-20180605"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.12-rc0"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.12-rc1"
},
{
"introduced": "0"
},
{
"last_affected": "9.4.12-rc2"
}
]
}