Skip to content
CVE PROGRAM SOURCE RECORD7.2 High

CVE-2024-13009

Eclipse Jetty GZIP buffer release

Description

In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation Jetty

Default version status: unaffected

  • 9.4.0 to ≤ 9.4.56affected

References