CVE-2017-7656: Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling
Summary
CVE-2017-7656: Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling). Affects org.eclipse.jetty:jetty-server across 2 version ranges.
< 9.3.24.v20180605
>= 9.4.0, < 9.4.11.v20180605
Fixed in 9.3.24.v20180605 or 9.4.11.v20180605, depending on the release line you run. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2017-7656 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The impacted package is org.eclipse.jetty:jetty-server, which is a component of the Eclipse Jetty web server and servlet container. Jetty is widely used in Java-based web applications to provide HTTP server capabilities. It is known for its lightweight and scalable architecture, making it a popular choice for embedded systems and high-performance applications. However, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled) of Jetty are susceptible to an HTTP Request Smuggling Vulnerability, which can lead to cache poisoning.
Vulnerability Detail
The HTTP Request Smuggling Vulnerability in Jetty arises from inconsistent handling of HTTP requests, allowing an attacker to manipulate the cache and potentially poison it. This vulnerability can be exploited to bypass security controls, perform session hijacking, or launch other types of attacks. The vulnerability has a CVSSv3 score of 7.5, indicating a high severity level. It affects versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled) of the org.eclipse.jetty:jetty-server package.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 9.3.24.v201806059.3.24.v20180605 -
>= 9.4.0, < 9.4.11.v201806059.4.11.v20180605
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
There is no specific workaround provided for this vulnerability. It is advised to update the package to the fixed versions mentioned above.
Conclusion
In conclusion, the org.eclipse.jetty:jetty-server package is vulnerable to an HTTP Request Smuggling Vulnerability, which can result in cache poisoning. It is crucial to update to the fixed versions mentioned above to mitigate the risk. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The vulnerability can lead to cache poisoning, bypassing security controls, and potential session hijacking.
Versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled) are affected.
The vulnerability has a CVSSv3 score of 7.5, indicating a high severity level.
There may be known exploits for this vulnerability, so it is crucial to update to the fixed versions as soon as possible.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability. Vulert provides real-time monitoring and alerts for open-source vulnerabilities in software.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
