CVE-2024-9823

Summary

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.

Affected Software

Weaknesses

• CWE-400: CWE-400 Uncontrolled Resource Consumption

Workarounds

The DoSFilter can be configured to not use sessions for tracking usage by setting the trackSessions init parameter to false. This will then use only the IP tracking mechanism, which is not vulnerable.

Sessions can also be configured to have aggressive passivation or inactivation limits.

ADP Enrichment

CISA ADP Vulnrichment

• SSVC:
• Exploitation: none
  • Automatable: yes
  • Technical Impact: partial

CVE Program Container

Additional References

• https://security.netapp.com/advisory/ntap-20250306-0006/
• https://lists.debian.org/debian-lts-announce/2025/04/msg00001.html

References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/39
• https://github.com/jetty/jetty.project/issues/1256

• ←Previous
• Next→