CVE-2024-7708
published 2026-07-14CVE-2024-7708: For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but…
PriorityP339high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
0.44%
37.1th percentile
For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.
This is particularly the case for 100-Continue, but any request where the network is slow can leak.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| eclipse | jetty | >= 10.0.7 < 10.0.23 | 10.0.23 |
| eclipse | jetty | >= 11.0.7 < 11.0.23 | 11.0.23 |
| eclipse_foundation | eclipse_jetty | >= 10.0.7 < 10.0.23 | 10.0.23 |
| eclipse_foundation | eclipse_jetty | >= 11.0.7 < 11.0.23 | 11.0.23 |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
jetty: Eclipse Jetty: Denial of Service due to buffer leak in handling certain HTTP requests
vendor_redhat·2026-07-14·CVSS 7.5
CVE-2024-7708 [HIGH] CWE-772 jetty: Eclipse Jetty: Denial of Service due to buffer leak in handling certain HTTP requests
jetty: Eclipse Jetty: Denial of Service due to buffer leak in handling certain HTTP requests
For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.
This is particularly the case for 100-Continue, but any request where the network is slow can leak.
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending specially crafted HTTP requests. Specifically, a buffer leak occurs when processing requests that have a body but read zero bytes, such as 100-Continue requests, or during slow network conditions. This can lead to resource exhaustion and make the server unavailable.
Statement: Red Hat's version of Eclipse Jetty (9.0.3) shipped in Red Hat Enterprise Linux 7 is not affect
GHSA
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
ghsa·2026-07-22
CVE-2024-7708 [HIGH] CWE-400 Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
### Impact
The original report:
> Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.
After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer.
This is particularly the case for 100-Continue, but any request where the network is slow can leak.
### Affected Versions
* Jetty 11.0.0-11.0.22 (EOL)
* Jetty 10.0.0-10.0.22 (EOL)
### Patched Versions
* Jetty 11.0.23
* Jetty 10.0.23
### Patches
https://github.com/jetty/jetty.project/pull/12156
### Workarounds
No workarounds.
VulDB
Eclipse Jetty up to 10.0.22/11.0.22 HTTP Request buffer overflow (WID-SEC-2026-2314)
vuldb·2026-07-14·CVSS 7.5
CVE-2024-7708 [HIGH] Eclipse Jetty up to 10.0.22/11.0.22 HTTP Request buffer overflow (WID-SEC-2026-2314)
A vulnerability described as critical has been identified in Eclipse Jetty up to 10.0.22/11.0.22. Affected is an unknown function of the component HTTP Request Handler. Such manipulation leads to buffer overflow.
This vulnerability is listed as CVE-2024-7708. The attack may be performed from remote. There is no available exploit.
No detection rules found.
No public exploits indexed.
2026-07-14
Published