CVE-2024-7708: Eclipse Jetty DoS Vulnerability Due to Memory Leak in 100-Continue Requests
Summary
CVE-2024-7708: Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests. Affects org.eclipse.jetty:jetty-server across 2 version ranges.
>= 10.0.7, < 10.0.23
>= 11.0.7, < 11.0.23
Fixed in 10.0.23 or 11.0.23, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a widely used open-source Java-based web server and servlet container that provides a robust platform for developing and deploying web applications. It is known for its scalability, performance, and support for modern web standards. However, certain versions of Jetty are vulnerable to a Denial of Service (DoS) attack due to improper handling of 100-Continue requests, which can lead to memory leaks and server instability.
Vulnerability Detail
The vulnerability arises from the server's handling of 100-Continue requests, which can lead to a memory leak. Specifically, when a request has a body but ends up reading 0 bytes, it leaks a buffer. This issue is exacerbated in scenarios where the network is slow, allowing attackers to exploit this behavior to cause a Denial of Service state by consuming server memory.
How To Fix
Fixed versions by release line
The minimum fixed version depends on the release line you run.
-
>= 10.0.7, < 10.0.2310.0.23 -
>= 11.0.7, < 11.0.2311.0.23
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
Currently, there are no effective workarounds available to mitigate this vulnerability. It is strongly recommended to update to the patched versions as soon as possible.
Conclusion
CVE-2024-7708 represents a significant risk for applications using affected versions of Eclipse Jetty. It is essential to update to the patched versions to prevent potential Denial of Service attacks caused by memory leaks. Regular monitoring and vulnerability management practices, such as using tools like Vulert, can help maintain the security of your applications.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
CVE-2024-7708 is a vulnerability in Eclipse Jetty that allows for Denial of Service attacks due to memory leaks when handling 100-Continue requests.
The affected versions include Jetty 11.0.0 to 11.0.22 and Jetty 10.0.0 to 10.0.22.
You can use Vulert to monitor and alert for open-source vulnerabilities in your software. Check your application's pom.xml file using the Vulert playground without any signup.
The CVSS score of this vulnerability is 7.5, indicating a high severity level.
While there are no workarounds available, it is crucial to plan for an update to the patched versions as soon as possible to mitigate the risk.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
