CVE-2011-4461: Improper Input Validation in Jetty
Summary
CVE-2011-4461: Improper Input Validation in Jetty. Affects org.eclipse.jetty:jetty-server versions < 8.1.0.RC4. Fixed in 8.1.0.RC4. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
Jetty is a popular open-source web server and servlet container written in Java. It provides a lightweight and scalable solution for serving web applications. The vulnerable package, org.eclipse.jetty:jetty-server, is a component of Jetty responsible for handling server-side functionality. This vulnerability affects versions of Jetty up to and including 8.1.0.RC2.
Vulnerability Detail
The vulnerability in Jetty arises from improper input validation when computing hash values for form parameters. The server does not adequately restrict the ability to trigger hash collisions predictably. This flaw can be exploited by remote attackers to cause a denial of service (CPU consumption) by sending a large number of crafted parameters. By exploiting this vulnerability, an attacker can overwhelm the server's resources, leading to degraded performance or even a complete service outage.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
8.1.0.RC4
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
If upgrading the package is not immediately feasible, a temporary workaround can be implemented by implementing input validation and rate limiting mechanisms at the application level. This can help mitigate the risk of hash collision attacks and reduce the impact of potential denial of service attacks. However, it is strongly advised to prioritize upgrading to the fixed version as soon as possible.
Conclusion
The vulnerability in Jetty's org.eclipse.jetty:jetty-server package can be exploited by remote attackers to cause a denial of service by triggering hash collisions. To mitigate this vulnerability, it is crucial to upgrade to version 8.1.0.RC4 or later. Implementing input validation and rate limiting mechanisms at the application level can provide temporary mitigation. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The vulnerability allows remote attackers to cause a denial of service by consuming excessive CPU resources. This can lead to degraded performance or a complete service outage.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it for any open-source vulnerabilities, including this one.
While there is no known public exploit for this vulnerability, it is still important to apply the necessary fixes to prevent potential attacks and ensure the security of your application.
Implementing input validation and rate limiting mechanisms at the application level can help mitigate the risk of hash collision attacks and reduce the impact of potential denial of service attacks. However, upgrading to the fixed version is the recommended approach.
You can find more information about this vulnerability, including the CVE identifier, on the Vulert website at Vulert Scanner.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
