Headline
GHSA-g8m5-722r-8whq: Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
Impact
Remote DOS attack can cause out of memory
Description
There exists a security vulnerability in Jetty’s ThreadLimitHandler.getRemote() which
can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By
repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the
server’s memory.
Affected Versions
- Jetty 12.0.0-12.0.8 (Supported)
- Jetty 11.0.0-11.0.23 (EOL)
- Jetty 10.0.0-10.0.23 (EOL)
- Jetty 9.3.12-9.4.55 (EOL)
Patched Versions
- Jetty 12.0.9
- Jetty 11.0.24
- Jetty 10.0.24
- Jetty 9.4.56
Workarounds
Do not use ThreadLimitHandler.
Consider use of QoSHandler instead to artificially limit resource utilization.
References
Jetty 12 - https://github.com/jetty/jetty.project/pull/11723
- GitHub Advisory Database
- GitHub Reviewed
- CVE-2024-8184
Eclipse Jetty’s ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
Moderate severity GitHub Reviewed Published Oct 14, 2024 in jetty/jetty.project • Updated Oct 14, 2024
Package
maven org.eclipse.jetty:jetty-server (Maven)
Affected versions
>= 12.0.0, <= 12.0.8
>= 10.0.0, <= 10.0.23
>= 11.0.0, <= 11.0.23
>= 9.3.12, <= 9.4.55
Patched versions
12.0.9
10.0.24
11.0.24
9.4.56
Published to the GitHub Advisory Database
Oct 14, 2024
Last updated
Oct 14, 2024
Related news
Red Hat Security Advisory 2024-9571-03 - Streams for Apache Kafka 2.8.0 is now available from the Red Hat Customer Portal. Issues addressed include denial of service and man-in-the-middle vulnerabilities.