CVE-2024-6763: Eclipse Jetty HTTP URI Parsing Vulnerability Leading to Open Redirect and SSRF Attacks
Summary
CVE-2024-6763: Eclipse Jetty URI parsing of invalid authority. Affects org.eclipse.jetty:jetty-http versions >= 7.0.0, < 12.0.12. Fixed in 12.0.12. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2024-6763 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a lightweight, highly scalable Java-based web server and Servlet engine known for its performance and flexibility. It includes a utility class, HttpURI, which is responsible for parsing URIs and URLs. However, this class has been found to perform insufficient validation on the authority segment of a URI, making it vulnerable to specific attack vectors.
Vulnerability Detail
The vulnerability arises from the HttpURI class's inadequate validation of the authority section of a URI. When presented with malformed URIs that may include illegal user info (e.g., username:password#@hostname:port), the class does not fail the parsing process. This discrepancy can lead to different interpretations of the host name between Jetty and common web browsers, potentially allowing attackers to exploit this behavior for open redirect or Server-Side Request Forgery (SSRF) attacks. The impact is particularly significant for developers who rely on Jetty's URI handling for security measures, as attackers may bypass blocklists and redirect requests to malicious hosts.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.0.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As an immediate workaround, applications should avoid passing decoded user data as an encoded URI to any URI class or method, including HttpURI. This practice can help mitigate the risk of exploitation until an upgrade can be performed.
Conclusion
CVE-2024-6763 highlights a critical vulnerability in the Eclipse Jetty HTTP URI parsing mechanism, which can lead to serious security issues if not addressed. Users are strongly advised to upgrade to the latest version of the affected package and implement recommended workarounds to protect their applications.
See every vulnerability recorded for org.eclipse.jetty:jetty-http →
FAQ
CVE-2024-6763 is a vulnerability in the Eclipse Jetty HTTP URI parsing that allows for insufficient validation of the authority segment, potentially leading to open redirect and SSRF attacks.
The vulnerability affects versions of org.eclipse.jetty:jetty-http up to and including 12.0.11. Users should upgrade to version 12.0.12 or later.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. By checking your pom.xml file on the Vulert playground, you can determine if your application is affected by this vulnerability.
The vulnerability can lead to unauthorized access through open redirects and SSRF attacks, allowing attackers to bypass security measures and redirect requests to malicious hosts.
If an immediate upgrade is not possible, implement workarounds by avoiding the passing of decoded user data as encoded URIs to mitigate the risk of exploitation.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-http.
