CVE-2024-6762

Summary

Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.

Affected Software

Weaknesses

• CWE-400: CWE-400 Uncontrolled Resource Consumption

Workarounds

The session usage is intrinsic to the design of the PushCacheFilter. The issue can be avoided by:

• not using the PushCacheFilter. Push has been deprecated by the various IETF specs and early hints responses should be used instead.

• reducing the reducing the idle timeout on unauthenticated sessions will reduce the time such session stay in memory.

• configuring a session cache to use session passivation https://jetty.org/docs/jetty/12/programming-guide/server/session.html , so that sessions are not stored in memory, but rather in a database or file system that may have significantly more capacity than memory.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: no
  • Technical Impact: partial

CVE Program Container

Additional References

• https://lists.debian.org/debian-lts-announce/2025/04/msg00001.html

References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-r7m4-f9h5-gr79
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/24
• https://github.com/jetty/jetty.project/pull/9715
• https://github.com/jetty/jetty.project/pull/9716
• https://github.com/jetty/jetty.project/pull/10756
• https://github.com/jetty/jetty.project/pull/10755

• ←Previous
• Next→