{"id":"GHSA-9299-c6m4-mjhc","summary":"Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests","details":"### Impact\nThe original report:\n\n\u003e Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.\n\nAfter investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.\n\n### Affected Versions\n\n* Jetty 11.0.0-11.0.22 (EOL)\n* Jetty 10.0.0-10.0.22 (EOL)\n\n### Patched Versions\n\n* Jetty 11.0.23\n* Jetty 10.0.23\n\n### Patches\n\nhttps://github.com/jetty/jetty.project/pull/12156\n\n### Workarounds\n\nNo workarounds.","aliases":["CVE-2024-7708"],"modified":"2026-07-22T23:25:41.033205Z","published":"2026-07-22T22:58:29Z","database_specific":{"nvd_published_at":"2026-07-14T09:16:39Z","cwe_ids":["CWE-400","CWE-401"],"severity":"HIGH","github_reviewed":true,"github_reviewed_at":"2026-07-22T22:58:29Z"},"references":[{"type":"WEB","url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-9299-c6m4-mjhc"},{"type":"ADVISORY","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7708"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/pull/12156"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/commit/8259eabbc70ae7fc2d525f1e95b43fbdfd2ad097"},{"type":"PACKAGE","url":"https://github.com/jetty/jetty.project"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.23"},{"type":"WEB","url":"https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.23"},{"type":"WEB","url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29"}],"affected":[{"package":{"name":"org.eclipse.jetty:jetty-server","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.7"},{"fixed":"10.0.23"}]}],"versions":["10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.20","10.0.21","10.0.22","10.0.7","10.0.8","10.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9299-c6m4-mjhc/GHSA-9299-c6m4-mjhc.json"}},{"package":{"name":"org.eclipse.jetty:jetty-server","ecosystem":"Maven","purl":"pkg:maven/org.eclipse.jetty/jetty-server"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.7"},{"fixed":"11.0.23"}]}],"versions":["11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.20","11.0.21","11.0.22","11.0.7","11.0.8","11.0.9"],"database_specific":{"source":"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-9299-c6m4-mjhc/GHSA-9299-c6m4-mjhc.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}