CVE-2019-17632: Unescaped exception messages in error responses in Jetty
Summary
CVE-2019-17632: Unescaped exception messages in error responses in Jetty. Affects org.eclipse.jetty:jetty-server across 3 version ranges.
>= 9.4.21.v20190926, < 9.4.24.v20191120
>= 9.4.22.v20191022, < 9.4.24.v20191120
>= 9.4.23.v20191118, < 9.4.24.v20191120
Fixed in 9.4.24.v20191120. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2019-17632 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The package under scrutiny is org.eclipse.jetty:jetty-server. It is a component of the Eclipse Jetty web server and servlet container. Jetty is a popular open-source project that provides a lightweight and scalable server for Java-based web applications. The jetty-server package specifically handles the server-side functionality of Jetty, including request handling and response generation.
Vulnerability Detail
The vulnerability identified as CVE-2019-17632 affects Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118. When generating default unhandled error responses in text/html and text/json content types, the exception messages in stacktraces included in the error output are not properly escaped. This can lead to the exposure of sensitive information contained in the exception messages, potentially enabling attackers to gain insights into the system's internal workings and exploit further vulnerabilities.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.4.24.v20191120
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There is no known workaround for this vulnerability. It is essential to apply the recommended fix by upgrading to the patched version of Jetty.
Conclusion
In conclusion, the vulnerability CVE-2019-17632 exposes unescaped exception messages in error responses in Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118. To mitigate this issue, it is essential to upgrade to Jetty version 9.4.24.v20191120 or later. This upgrade ensures that exception messages in error responses are properly escaped, preventing the exposure of sensitive information. For further support on vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
Eclipse Jetty is a popular open-source web server and servlet container written in Java. It provides a lightweight and scalable solution for hosting Java-based web applications.
The vulnerability allows unescaped exception messages to be exposed in error responses, potentially revealing sensitive information. This information can be leveraged by attackers to gain insights into the system's internal workings and potentially exploit further vulnerabilities.
The vulnerability affects Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118.
To fix this vulnerability, it is recommended to upgrade to Jetty version 9.4.24.v20191120 or later. Updating the jetty-server package in your Maven project to the patched version will address the issue.
No, there is no known workaround for this vulnerability. It is crucial to apply the recommended fix by upgrading to the patched version of Jetty.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
