Most recent entries from all

bdu:2025-03454

certfr-2025-avi-0210 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Certaines d'entre elles permettent à un attaq…

certfr-2025-avi-0210

CLEANSTART-2026-AC10054 — Security fix for CVE-2024-8184 applied in: apache-hive 4.0.0-r1, cassandra-reaper-fips 3.6.1-r3, cassandra-reaper-fips…

Affected: CleanStart: apache-hive, CleanStart: cassandra-reaper-fips, CleanStart: solr, CleanStart: stargate

CVE-2024-8184 affects multiple packages. This issue is resolved in later releases. See references for individual vulnerability details.

EUVD-2026-257779

fkie_cve-2024-8184

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

GHSA-g8m5-722r-8whq — Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks

Affected: Maven: org.eclipse.jetty:jetty-server

### Impact Remote DOS attack can cause out of memory

### Description There exists a security vulnerability in Jetty's `ThreadLimitHandler.getRemote()` which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

### Affected Versions

* Jetty 12.0.0-12.0.8 (Supported) * Jetty 11.0.0-11.0.23 (EOL) * Jetty 10.0.0-10.0.23 (EOL) * Jetty 9.3.12-9.4.55 (EOL)

### Patched Versions

* Jetty 12.0.9 * Jetty 11.0.24 * Jetty 10.0.24 * Jetty 9.4.56

### Workarounds

Do not use `ThreadLimitHandler`. Consider use of `QoSHandler` instead to artificially limit resource utilization.

### References

Jetty 12 - https://github.com/jetty/jetty.project/pull/11723

openSUSE-SU-2024:14408-1 — jetty-annotations-9.4.56-2.1 on GA media

jetty-annotations-9.4.56-2.1 on GA media

RHSA-2024:11023 — Red Hat Security Advisory: HawtIO 4.1.0 for Red Hat build of Apache Camel 4 Release and security update.

quarkus-core: Leak of local configuration properties into Quarkus applications braces: fails to limit the number of characters it can handle undertow: Improper State Management in Proxy Protocol parsing causes information leakage org.eclipse.jetty:jetty-server: jetty: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks spring-webmvc: Path Traversal Vulnerability in Spring Applications Using RouterFunctions and FileSystemResource express: Improper Input Handling in Express Redirects send: Code Execution Vulnerability in Send Library serve-static: Improper Sanitization in serve-static path-to-regexp: Backtracking regular expressions cause ReDoS

SUSE-SU-2024:3720-1 — Security update for jetty-minimal

Security update for jetty-minimal

UBUNTU-CVE-2024-8184

Affected: Ubuntu:14.04:LTS: jetty, Ubuntu:16.04:LTS: jetty

WID-SEC-W-2024-3176 — Eclipse Jetty: Mehrere Schwachstellen

Ein entfernter anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um einen Denial of Service Angriff zu erzeugen und Daten zu manipulieren.