GHSA-q4rv-gq96-w7c5

Source

https://github.com/advisories/GHSA-q4rv-gq96-w7c5

Import Source

https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2025/05/GHSA-q4rv-gq96-w7c5/GHSA-q4rv-gq96-w7c5.json

JSON Data

https://api.osv.dev/v1/vulns/GHSA-q4rv-gq96-w7c5

Aliases

CVE-2024-13009

Related

Published

2025-05-08T19:28:34Z

Modified

2025-05-08T19:57:34.204933Z

Severity

7.2 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N CVSS Calculator

Summary

**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request

Details

In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

Database specific

{
    "nvd_published_at": "2025-05-08T18:15:41Z",
    "cwe_ids": [
        "CWE-404"
    ],
    "severity": "HIGH",
    "github_reviewed": true,
    "github_reviewed_at": "2025-05-08T19:28:34Z"
}

References

Affected packages

Maven / org.eclipse.jetty:jetty-server

Package

Name: org.eclipse.jetty:jetty-server; View open source insights on deps.dev
Purl: pkg:maven/org.eclipse.jetty/jetty-server

Affected ranges

Type: ECOSYSTEM
Events: Introduced

9.4.0

Fixed

9.4.57.v20241219

Affected versions

9.*

9.4.0.v20161208

9.4.0.v20180619

9.4.1.v20170120

9.4.1.v20180619

9.4.2.v20170220

9.4.2.v20180619

9.4.3.v20170317

9.4.3.v20180619

9.4.4.v20170414

9.4.4.v20180619

9.4.5.v20170502

9.4.5.v20180619

9.4.6.v20170531

9.4.6.v20180619

9.4.7.RC0

9.4.7.v20170914

9.4.7.v20180619

9.4.8.v20171121

9.4.8.v20180619

9.4.9.v20180320

9.4.10.RC0

9.4.10.RC1

9.4.10.v20180503

9.4.11.v20180605

9.4.12.RC0

9.4.12.RC1

9.4.12.RC2

9.4.12.v20180830

9.4.13.v20181111

9.4.14.v20181114

9.4.15.v20190215

9.4.16.v20190411

9.4.17.v20190418

9.4.18.v20190429

9.4.19.v20190610

9.4.20.v20190813

9.4.21.v20190926

9.4.22.v20191022

9.4.23.v20191118

9.4.24.v20191120

9.4.25.v20191220

9.4.26.v20200117

9.4.27.v20200227

9.4.28.v20200408

9.4.29.v20200521

9.4.30.v20200611

9.4.31.v20200723

9.4.32.v20200930

9.4.33.v20201020

9.4.34.v20201102

9.4.35.v20201120

9.4.36.v20210114

9.4.37.v20210219

9.4.38.v20210224

9.4.39.v20210325

9.4.40.v20210413

9.4.41.v20210516

9.4.42.v20210604

9.4.43.v20210629

9.4.44.v20210927

9.4.45.v20220203

9.4.46.v20220331

9.4.47.v20220610

9.4.48.v20220622

9.4.49.v20220914

9.4.50.v20221201

9.4.51.v20230217

9.4.52.v20230823

9.4.53.v20231009

9.4.54.v20240208

9.4.55.v20240627

9.4.56.v20240826

Database specific

{
    "last_known_affected_version_range": "<= 9.4.56"
}