-
CVSS Score
-Basic Information
CVE ID
-
GHSA ID
-
EPSS Score
-
CWE
-
Published
-
Updated
-
KEV Status
-
Technology
-
Technical Details
Vulnerability Intelligence
Miggo AI
Miggo AIMiggo AIMiggo AIRoot Cause AnalysisThe vulnerability documentation explicitly identifies ThreadLimitHandler.getRemote() as the vulnerable component. The CWE-400/770 classifications indicate uncontrolled resource consumption, consistent with the described OOM attack vector. The pull request #11723 modifying ThreadLimitHandler and the workaround recommendation to avoid it further corroborate this as the vulnerable entry point. The method's role in tracking connections likely creates unbounded memory allocation when handling malicious requests.
JavaJava| Package Name | Ecosystem | Vulnerable Versions | First Patched Version |
|---|---|---|---|
| org.eclipse.jetty:jetty-server | maven | >= 12.0.0, <= 12.0.8 | 12.0.9 |
| org.eclipse.jetty:jetty-server | maven | >= 10.0.0, <= 10.0.23 | 10.0.24 |
| org.eclipse.jetty:jetty-server |
| maven |
| >= 11.0.0, <= 11.0.23 |
| 11.0.24 |
| org.eclipse.jetty:jetty-server | maven | >= 9.3.12, <= 9.4.55 | 9.4.56 |
Ongoing coverage of React2Shell