CVE-2021-34428: org.eclipse.jetty:jetty-server - SessionListener Vulnerability
Summary
CVE-2021-34428: SessionListener can prevent a session from being invalidated breaking logout. Affects org.eclipse.jetty:jetty-server across 3 version ranges.
< 9.4.41
>= 10.0.0, < 10.0.3
>= 11.0.0, < 11.0.3
Fixed in 9.4.41, 10.0.3 or 11.0.3, depending on the release line you run. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2021-34428 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The org.eclipse.jetty:jetty-server package is a Java-based HTTP server and servlet container. It provides a lightweight and scalable server for web applications. The SessionListener is a component within this package that handles session management and destruction. However, a vulnerability has been identified in the SessionListener that can prevent a session from being invalidated during logout.
Vulnerability Detail
The vulnerability (CVE-2021-34428) arises when an exception is thrown from the SessionListener#sessionDestroyed() method. In such cases, the session ID is not invalidated in the session ID manager. This issue is particularly critical in deployments with clustered sessions and multiple contexts, as it can result in a session not being properly invalidated. Consequently, an application used on a shared computer may be left logged in. Although there is no known method for an attacker to exploit this vulnerability directly, they can rely on an application to throw the exception. Additionally, the getLastAccessedTime() method within sessionDestroyed() may throw an IllegalStateException, potentially violating the servlet specification. This can lead to applications failing to log out even when called to do so. It is important to note that if an application was only tested on a non-clustered environment, it may fail to log out in a clustered environment with multiple contexts.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 9.4.419.4.41 -
>= 10.0.0, < 10.0.310.0.3 -
>= 11.0.0, < 11.0.311.0.3
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, applications can catch all Throwables within their SessionListener#sessionDestroyed() implementations. By handling any exceptions, the session ID will be properly invalidated, preventing the logout issue.
Conclusion
The org.eclipse.jetty:jetty-server package is vulnerable to a session invalidation issue during logout. By updating to the recommended versions or applying the provided workaround, this vulnerability can be mitigated. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The impact of this vulnerability is that a session may not be properly invalidated during logout, leaving an application logged in on a shared computer.
There is no known method for an attacker to directly exploit this vulnerability. They would need to rely on an application to throw the exception that prevents session invalidation.
While the vulnerability itself is not specific to clustered environments, the issue of failing to log out due to the getLastAccessedTime() method can occur in both clustered and non-clustered environments.
Yes, updating the org.eclipse.jetty:jetty-server package to version 9.4.41 or later, 10.0.3 or later, or 11.0.3 or later will address this vulnerability.
Yes, applications can catch all Throwables within their SessionListener#sessionDestroyed() implementations as a temporary workaround.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
