GHSA-9299-c6m4-mjhc: Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Impact
The original report:
Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.
After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer.
This is particularly the case for 100-Continue, but any request where the network is slow can leak.
Affected Versions
- Jetty 11.0.0-11.0.22 (EOL)
- Jetty 10.0.0-10.0.22 (EOL)
Patched Versions
- Jetty 11.0.23
- Jetty 10.0.23
Patches
https://github.com/jetty/jetty.project/pull/12156
Workarounds
No workarounds.
Details
Original advisory: https://github.com/advisories/GHSA-9299-c6m4-mjhc
Exploitation outlook
EPSS (FIRST.org) estimates each CVE’s probability of exploitation in the next 30 days — here is the CSIRTS.com read on those numbers.
- Low exploitation riskCVE-2024-77080.25% 30-day exploitation probability — currently an unlikely target, but scores change as exploit code circulates. Riskier than 17% of all scored CVEs.
Referenced CVEs
| CVE | CSIRTS overview | External |
|---|---|---|
| CVE-2024-7708 | coverage & exploitation status | NVD · CVE.org |
Same CVEs, other sources
How other CERTs, PSIRTs and databases cover the vulnerabilities in this advisory.
More from GitHub Security Advisories
- mediumGHSA-jr6p-8pjj-mfx6: Capsule has an incomplete fix of CVE-2026-22872: TenantResource RawItems and Generators s…2026-07-31
- mediumGHSA-68cj-mvg9-rgm2: Capsule: CapsuleConfiguration NodeMetadata regex fields lack webhook validation, allowing…2026-07-31
- mediumGHSA-ff84-5f28-78qj: re2: Out-of-bounds heap read in `exec`/`test`/`match` via attacker-influenced `lastIndex`…2026-07-31
- mediumGHSA-6hxr-mr5r-9836: re2: Global `String.prototype.match` with an empty-matchable pattern never advances → inf…2026-07-31
- mediumGHSA-x83g-979r-f5fh: Sylius Mollie Plugin has unauthenticated IDOR that leaks order token and customer PII2026-07-31