CVE-2024-6763: Eclipse Jetty HTTP URI Parsing Vulnerability Leading to SSRF and Open Redirect Attacks
Summary
CVE-2024-6763: Eclipse Jetty URI parsing of invalid authority. Affects org.eclipse.jetty:jetty-http versions >= 7.0.0, < 12.0.12. Fixed in 12.0.12. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2024-6763 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a lightweight and highly scalable Java-based web server and Servlet engine. It provides a utility class called HttpURI for parsing URIs and URLs. Jetty is widely used in various applications due to its performance and ease of integration. However, the HttpURI class has been found to have insufficient validation on the authority segment of a URI, making it vulnerable to specific attacks.
Vulnerability Detail
The vulnerability arises from the HttpURI class's inadequate validation of the authority section of a URI. When presented with malformed URIs containing illegal authority segments, the class does not fail the parsing process. This can lead to discrepancies between the host extracted by Jetty and that of common web browsers, potentially allowing attackers to exploit the system through open redirect or Server-Side Request Forgery (SSRF) attacks. The issue is particularly concerning when applications rely on Jetty's URI handling for security checks, as attackers can bypass blocklists and redirect requests to malicious hosts.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the version below is the minimum fixed release for this vulnerability.
If you need the minimum change
12.0.12
This is the first release that contains the fix.
Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, applications should avoid passing decoded user data as an encoded URI to the HttpURI class. This can help mitigate the risk of SSRF and open redirect vulnerabilities until an upgrade can be performed.
Conclusion
The CVE-2024-6763 vulnerability in the Eclipse Jetty HttpURI class poses significant risks due to its inadequate URI authority validation. It is crucial for developers to upgrade to the patched version to mitigate potential SSRF and open redirect attacks. Utilizing tools like Vulert can help in monitoring and managing such vulnerabilities effectively.
See every vulnerability recorded for org.eclipse.jetty:jetty-http →
FAQ
CVE-2024-6763 is a vulnerability in the Eclipse Jetty HttpURI class that allows for insufficient validation of the authority segment of a URI, potentially leading to SSRF and open redirect attacks.
You can check if your application is affected by using Vulert, which monitors and alerts for open-source vulnerabilities in your software. You can use the Vulert playground at Vulert Scanner without any signup.
SSRF (Server-Side Request Forgery) attacks allow an attacker to send crafted requests from the server to internal or external resources. Open redirect attacks enable attackers to redirect users to malicious sites.
The CVSS score of this vulnerability is 3.7, indicating a low severity level.
If immediate upgrading is not possible, implement the recommended workaround by avoiding the passing of decoded user data to the HttpURI class.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-http.
