GHSA-r7m4-f9h5-gr79LowCVSS 3.1
Eclipse Jetty's PushSessionCacheFilter can cause remote DoS attacks
🔗 CVE IDs covered (1)
📋 Description
Impact
Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.
Patches
- https://github.com/jetty/jetty.project/pull/9715
- https://github.com/jetty/jetty.project/pull/9716
Workarounds
The session usage is intrinsic to the design of the PushCacheFilter. The issue can be avoided by:
- not using the PushCacheFilter. Push has been deprecated by the various IETF specs and early hints responses should be used instead.
- reducing the reducing the idle timeout on unauthenticated sessions will reduce the time such session stay in memory.
- configuring a session cache to use session passivation, so that sessions are not stored in memory, but rather in a database or file system that may have significantly more capacity than memory.
References
- https://github.com/jetty/jetty.project/pull/10756
- https://github.com/jetty/jetty.project/pull/10755
🎯 Affected products3
- maven/org.eclipse.jetty:jetty-servlets:>= 10.0.0, <= 10.0.17
- maven/org.eclipse.jetty:jetty-servlets:>= 11.0.0, <= 11.0.17
- maven/org.eclipse.jetty:jetty-servlets:>= 12.0.0, <= 12.0.3
🔗 References (9)
- https://github.com/jetty/jetty.project/security/advisories/GHSA-r7m4-f9h5-gr79
- https://nvd.nist.gov/vuln/detail/CVE-2024-6762
- https://github.com/jetty/jetty.project/pull/10755
- https://github.com/jetty/jetty.project/pull/10756
- https://github.com/jetty/jetty.project/pull/9715
- https://github.com/jetty/jetty.project/pull/9716
- https://gitlab.eclipse.org/security/cve-assignement/-/issues/24
- https://lists.debian.org/debian-lts-announce/2025/04/msg00001.html
- https://github.com/advisories/GHSA-r7m4-f9h5-gr79