CVE-2024-6763
published 2024-10-14CVE-2024-6763: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The…
PriorityP428medium5.3CVSS 3.1
AVNACLPRNUINSUCNILAN
EPSS
0.97%
57.8th percentile
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.
The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI
differs from the common browsers in how it handles a URI that would be
considered invalid if fully validated against the RRC. Specifically HttpURI
and the browser may differ on the value of the host extracted from an
invalid URI and thus a combination of Jetty and a vulnerable browser may
be vulnerable to a open redirect attack or to a SSRF attack if the URI
is used after passing validation checks.
Affected
3 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jetty9 | — | — |
| eclipse | jetty | >= 7.0.0 < 9.4.57 | 9.4.57 |
| eclipse_foundation | jetty | 7.0.0 – 12.0.11 | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
osv5.3MEDIUM
vendor_oracle5.3LOW
vendor_debian3.7LOW
vendor_redhat3.7LOW
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Eclipse Jetty) — CVE-2024-6763
vendor_oracle·2025-07-15·CVSS 5.3
CVE-2024-6763 [LOW] Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Eclipse Jetty) — CVE-2024-6763
Oracle Oracle Fusion Middleware Risk Matrix: Third Party (Eclipse Jetty) vulnerability
CVE: CVE-2024-6763
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujul2025 (JUL 2025)
Oracle
Oracle Oracle Graph Server and Client Risk Matrix: Install (Eclipse Jetty) — CVE-2024-6763
vendor_oracle·2025-04-15·CVSS 5.3
CVE-2024-6763 [LOW] Oracle Oracle Graph Server and Client Risk Matrix: Install (Eclipse Jetty) — CVE-2024-6763
Oracle Oracle Graph Server and Client Risk Matrix: Install (Eclipse Jetty) vulnerability
CVE: CVE-2024-6763
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuapr2025 (APR 2025)
Oracle
Oracle Oracle REST Data Services Risk Matrix: General (Eclipse Jetty) — CVE-2024-6763
vendor_oracle·2025-01-15·CVSS 5.3
CVE-2024-6763 [LOW] Oracle Oracle REST Data Services Risk Matrix: General (Eclipse Jetty) — CVE-2024-6763
Oracle Oracle REST Data Services Risk Matrix: General (Eclipse Jetty) vulnerability
CVE: CVE-2024-6763
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpujan2025 (JAN 2025)
Red Hat
org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of invalid authority
vendor_redhat·2024-10-14·CVSS 3.7
CVE-2024-6763 [LOW] CWE-1286 org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of invalid authority
org.eclipse.jetty:jetty-http: jetty: Jetty URI parsing of invalid authority
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.
The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI
differs from the common browsers in how it handles a URI that would be
considered invalid if fully validated against the RRC. Specifically HttpURI
and the browser may differ on the value of the host extracted from an
invalid URI and thus a combination of Jetty and a vulnerable browser may
be vulnerable to a open redirect attack or to a SSRF attack if the URI
is used after passing validation checks.
A flaw was found in Jetty. The HttpURI class performs
Debian
CVE-2024-6763: jetty9 - Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servl...
vendor_debian·2024·CVSS 3.7
CVE-2024-6763 [LOW] CVE-2024-6763: jetty9 - Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servl...
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.
Scope: local
bookworm: open
bullseye: open
forky: open
sid: open
trixie: open
OSV
Eclipse Jetty URI parsing of invalid authority
osv·2024-10-14
CVE-2024-6763 [MEDIUM] Eclipse Jetty URI parsing of invalid authority
Eclipse Jetty URI parsing of invalid authority
## Summary
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, `HttpURI`, for URI/URL parsing.
The `HttpURI` class does insufficient validation on the authority segment of a URI. However the behaviour of `HttpURI` differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically `HttpURI` and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.
## Details
### Affected components
The vulnerable component
OSV
CVE-2024-6763: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine
osv·2024-10-14·CVSS 5.3
CVE-2024-6763 [MEDIUM] CVE-2024-6763: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.
GHSA
Eclipse Jetty URI parsing of invalid authority
ghsa·2024-10-14
CVE-2024-6763 [MEDIUM] CWE-1286 Eclipse Jetty URI parsing of invalid authority
Eclipse Jetty URI parsing of invalid authority
## Summary
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, `HttpURI`, for URI/URL parsing.
The `HttpURI` class does insufficient validation on the authority segment of a URI. However the behaviour of `HttpURI` differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically `HttpURI` and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.
## Details
### Affected components
The vulnerable component
No detection rules found.
No public exploits indexed.
2024-10-14
Published