-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AI
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.eclipse.jetty:jetty-servlets | maven | >= 10.0.0, <= 10.0.17 | 10.0.18 |
| org.eclipse.jetty:jetty-servlets | maven | >= 11.0.0, <= 11.0.17 | 11.0.18 |
| org.eclipse.jetty:jetty-servlets | maven | >= 12.0.0, <= 12.0.3 | 12.0.4 |
Miggo AIRoot Cause AnalysisThe vulnerability stems directly from the PushSessionCacheFilter's session management implementation. Multiple sources confirm this filter was deprecated in patches (PR #9715, #9716) due to its role in memory exhaustion attacks. The CWE-400/CWE-770 alignment indicates uncontrolled resource consumption from session caching. The filter's presence in vulnerable versions (<=10.0.17, <=11.0.17, <=12.0.3) and removal in patched versions confirms its role as the vulnerable component.
Ongoing coverage of React2Shell