CVE-2024-6762
Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks
Impact
### Impact Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory. ### Patches * https://github.com/jetty/jetty.project/pull/9715 * https://github.com/jetty/jetty.project/pull/9716 ### Workarounds The session usage is intrinsic to the design of the PushCacheFilter. The issue can be avoided by: + not using the PushCacheFilter. Push has been deprecated by the various IETF specs and early hints responses should be used instead. + reducing the reducing the idle timeout on unauthenticated sessions will reduce the time such session stay in memory. + configuring a session cache to use [session passivation](https://jetty.org/docs/jetty/12/programming-guide/server/session.html), so that sessions are not stored in memory, but rather in a database or file system that may have significantly more capacity than memory. ### References * https://github.com/jetty/jetty.project/pull/10756 * https://github.com/jetty/jetty.project/pull/10755
Affected packages
| Ecosystem | Package | Affected | Fixed in |
|---|---|---|---|
| maven | org.eclipse.jetty:jetty-servlets | >= 10.0.0, <= 10.0.17 | 10.0.18 |
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Eclipse | Jetty | from 10.0.0 before 10.0.18 from 11.0.0 before 11.0.18 from 12.0.0 before 12.0.4 |
Weakness classification
References
- NVD record
- CVE.org record
- GitHub advisory
- https://github.com/jetty/jetty.project/pull/10755
- https://github.com/jetty/jetty.project/pull/10756
- https://github.com/jetty/jetty.project/pull/9715
- https://github.com/jetty/jetty.project/pull/9716
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7m4-f9h5-gr79
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/24
- https://lists.debian.org/debian-lts-announce/2025/04/msg00001.html
- https://github.com/advisories/GHSA-r7m4-f9h5-gr79
- https://nvd.nist.gov/vuln/detail/CVE-2024-6762