« Volver al listado

CVE-2024-8184

Estado: ModificadaMedia (6.5)—

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Eclipse — Jetty

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2024-8184",
  "cveTags": [],
  "metrics": {
    "ssvcV203": [
      {
        "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
        "ssvcData": {
          "id": "CVE-2024-8184",
          "role": "CISA Coordinator",
          "options": [
            {
              "exploitation": "none"
            },
            {
              "automatable": "no"
            },
            {
              "technicalImpact": "partial"
            }
          ],
          "version": "2.0.3",
          "timestamp": "2024-10-15T17:41:50.744158Z"
        }
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Secondary",
        "source": "emo@eclipse.org",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 5.9,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "HIGH",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.2
      },
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "emo@eclipse.org",
      "affectedData": [
        {
          "repo": "https://github.com/jetty/jetty.project",
          "vendor": "Eclipse Foundation",
          "modules": [
            "jetty-server"
          ],
          "product": "Jetty",
          "versions": [
            {
              "status": "affected",
              "version": "9.3.12",
              "versionType": "semver",
              "lessThanOrEqual": "9.4.55"
            },
            {
              "status": "affected",
              "version": "10.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "10.0.23"
            },
            {
              "status": "affected",
              "version": "11.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "11.0.23"
            },
            {
              "status": "affected",
              "version": "12.0.0",
              "versionType": "semver",
              "lessThanOrEqual": "12.0.8"
            }
          ],
          "packageName": "org.eclipse.jetty:jetty-server",
          "collectionURL": "https://repo.maven.apache.org/maven2/",
          "defaultStatus": "unaffected"
        }
      ]
    }
  ],
  "published": "2024-10-14T16:15:04.380",
  "references": [
    {
      "url": "https://github.com/jetty/jetty.project/pull/11723",
      "tags": [
        "Patch"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://gitlab.eclipse.org/security/cve-assignement/-/issues/30",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "emo@eclipse.org"
    },
    {
      "url": "https://lists.debian.org/debian-lts-announce/2025/04/msg00001.html",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Secondary",
      "source": "emo@eclipse.org",
      "description": [
        {
          "lang": "en",
          "value": "CWE-400"
        }
      ]
    },
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-770"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack.  By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de seguridad en ThreadLimitHandler.getRemote() de Jetty que puede ser explotada por usuarios no autorizados para provocar un ataque de denegación de servicio (DoS) remoto. Al enviar repetidamente solicitudes manipuladas, los atacantes pueden generar errores OutofMemory y agotar la memoria del servidor."
    }
  ],
  "lastModified": "2026-06-17T08:22:04.520",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "38EE28A7-83A2-4D16-A1D7-197C1680C234",
              "versionEndExcluding": "9.4.56",
              "versionStartIncluding": "9.3.12"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "40B124FE-E76C-4612-8781-42CF3182E264",
              "versionEndExcluding": "10.0.24",
              "versionStartIncluding": "10.0.0"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "43B96569-B73B-4765-994F-809E5AE1A3CE",
              "versionEndExcluding": "11.0.24",
              "versionStartIncluding": "11.0.0"
            },
            {
              "criteria": "cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDCB79ED-6D2F-4A37-BB89-41EABF18EAC1",
              "versionEndExcluding": "12.0.9",
              "versionStartIncluding": "12.0.0"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "emo@eclipse.org"
}