CVE-2019-17638: Operation on a Resource after Expiration or Release in Jetty Server
Summary
CVE-2019-17638: Operation on a Resource after Expiration or Release in Jetty Server. Affects org.eclipse.jetty:jetty-server versions >= 9.4.27, < 9.4.30.v20200611. Fixed in 9.4.30.v20200611. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2019-17638 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
The Jetty Server, specifically versions 9.4.27.v20200227 to 9.4.29.v20200521, is an open-source Java HTTP server and servlet container. It provides a lightweight and scalable solution for handling web applications. The server is widely used in various Java-based projects and frameworks. However, a vulnerability has been identified in these versions of Jetty Server, which can lead to the exposure of sensitive data belonging to different clients.
Vulnerability Detail
The vulnerability in Jetty Server occurs when the server encounters too large response headers. In such cases, Jetty throws an exception to produce an HTTP 431 error. However, due to a double release of the ByteBuffer containing the HTTP response headers, two threads can acquire the same ByteBuffer from the pool. This leads to a race condition where one thread may write response data while another thread fills the ByteBuffer with different response data. As a result, a client expecting a specific response may receive sensitive data intended for another client, potentially compromising security and privacy.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
9.4.30.v20200611
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if upgrading to the latest version is not immediately feasible, developers can limit the response header size to avoid triggering the vulnerability. This can be achieved by configuring the server to reject or truncate response headers that exceed a certain size limit. However, this workaround may impact the functionality or compatibility of certain applications, so upgrading to the fixed version is strongly advised.
Conclusion
The vulnerability in Jetty Server versions 9.4.27.v20200227 to 9.4.29.v20200521 can lead to the exposure of sensitive data between clients due to a double release of the ByteBuffer containing response headers. To mitigate this risk, it is recommended to upgrade to Jetty Server version 9.4.30.v20200611 or later. Alternatively, developers can implement a temporary workaround by limiting the response header size. It is crucial to address this vulnerability promptly to prevent potential data breaches and unauthorized access. For further support and assistance, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The vulnerability allows for the exposure of sensitive data belonging to different clients. This can include HTTP session IDs, authentication credentials, and other confidential information.
You can use the Vulert Playground (https://vulert.com/scanner) to check if your application is affected by this vulnerability. Vulert monitors and alerts in real-time for open-source vulnerabilities using just the pom.xml file.
The vulnerability has a CVSS score of 9.4, indicating a critical severity level. It is crucial to address this vulnerability promptly to prevent potential data breaches and unauthorized access.
At the time of this report, there are no known public exploits targeting this specific vulnerability. However, it is essential to apply the recommended fix or workaround to mitigate any potential risks.
For further support and assistance in remediating this vulnerability, you can contact info@devnack.com. Our team of experts can provide guidance and help ensure the security of your application.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
