CVE catalog

CVE-2024-13009

jetty9: CVE-2024-13009

Severity: High · CVSS 7.2CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
Published: Jan 1, 2024, 12:00:00 AM UTC
Source: [NVD] · [CVE record]
EPSS: 0.55% · Oct 25, 2026

In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.

Vulnerable and fixed packages

Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.

Distribution	Package	Release	Version	Status
Debian	jetty9	sid	`9.4.58-2`	fixed
Debian	jetty9	forky	`9.4.58-2`	fixed
Debian	jetty9	trixie	`9.4.57-1.1~deb13u1`	fixed
Debian	jetty9	trixie-security	`9.4.57-1.1~deb13u1`	fixed
Debian	jetty9	bookworm	`9.4.57-1.1~deb12u1`	fixed
Debian	jetty9	bookworm-security	`9.4.57-1.1~deb12u1`	fixed
Opensuse	jetty-minimal	tumbleweed	`9.4.57-1.1`	fixed
Suse	jetty-minimal	linux enterprise module for development tools 15 sp6	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise module for development tools 15 sp7	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise module for package hub 15 sp6	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise module for package hub 15 sp7	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise high performance computing 15 sp3-ltss	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise high performance computing 15 sp4-espos	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise high performance computing 15 sp4-ltss	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise high performance computing 15 sp5-espos	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise high performance computing 15 sp5-ltss	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise server 15 sp3-ltss	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise server 15 sp4-ltss	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise server 15 sp5-ltss	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise server for sap applications 15 sp3	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise server for sap applications 15 sp4	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	linux enterprise server for sap applications 15 sp5	`9.4.57-150200.3.31.1`	fixed
Suse	jetty-minimal	enterprise storage 7.1	`9.4.57-150200.3.31.1`	fixed
Opensuse	jetty-minimal	leap 15.6	`9.4.57-150200.3.31.1`	fixed
Ubuntu	jetty9	18.04	`9.2.22-2`	vulnerable
Ubuntu	jetty9	18.04	`9.2.22-3`	vulnerable
Ubuntu	jetty9	18.04	`9.2.23-1`	vulnerable
Ubuntu	jetty9	18.04	`9.4.15-1~18.04.1ubuntu1`	vulnerable
Ubuntu	jetty9	20.04	`9.4.18-2build2`	vulnerable
Ubuntu	jetty9	20.04	`9.4.26-1`	vulnerable
Ubuntu	jetty9	22.04	`9.4.39-3`	vulnerable
Ubuntu	jetty9	22.04	`9.4.44-2`	vulnerable
Ubuntu	jetty9	22.04	`9.4.44-3`	vulnerable
Ubuntu	jetty9	22.04	`9.4.44-4`	vulnerable
Ubuntu	jetty9	22.04	`9.4.45-1`	vulnerable
Ubuntu	jetty9	24.04	`9.4.51-2`	vulnerable
Ubuntu	jetty9	24.04	`9.4.53-1`	vulnerable

Fixed-version evidence

Distribution	Package	Type	Release	Fixed version	Urgency	Origin	Bugs
Debian	jetty9	source	sid	`9.4.57-1`	not yet assigned	Not reported	Not reported
Debian	jetty9	source	forky	`9.4.57-1`	not yet assigned	Not reported	Not reported
Debian	jetty9	source	trixie	`9.4.57-1`	not yet assigned	Not reported	Not reported
Debian	jetty9	source	bookworm	`9.4.57-0+deb12u1`	not yet assigned	Not reported	Not reported
Opensuse	jetty-minimal	rpm	tumbleweed	`9.4.57-1.1`	Not reported	OPENSUSE-SU-2025:15160-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise module for development tools 15 sp6	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise module for development tools 15 sp7	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise module for package hub 15 sp6	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise module for package hub 15 sp7	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise high performance computing 15 sp3-ltss	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise high performance computing 15 sp4-espos	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise high performance computing 15 sp4-ltss	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise high performance computing 15 sp5-espos	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise high performance computing 15 sp5-ltss	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise server 15 sp3-ltss	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise server 15 sp4-ltss	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise server 15 sp5-ltss	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise server for sap applications 15 sp3	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise server for sap applications 15 sp4	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	linux enterprise server for sap applications 15 sp5	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Suse	jetty-minimal	rpm	enterprise storage 7.1	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported
Opensuse	jetty-minimal	rpm	leap 15.6	`9.4.57-150200.3.31.1`	Not reported	SUSE-SU-2025:01738-1	Not reported

OpenFactory catalog packages

Matching against OpenFactory catalog package versions is in progress.

[Debian 12 (Bookworm)]

[jetty9]Unknown
Details (4)
- 9.4.57-1.1~deb12u1 · all · bookworm
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
[libjetty9-extra-java]Unknown
Source package: [jetty9]
Details (4)
- 9.4.57-1.1~deb12u1 · all · bookworm
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
[libjetty9-java]Unknown
Source package: [jetty9]
Details (4)
- 9.4.57-1.1~deb12u1 · all · bookworm
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12
- 9.4.57-1.1~deb12u1 · all · bookworm-security
  Fixed · Fixed: 9.4.57-0+deb12u1
  dsa · jetty9 · debian · bookworm; dsa · jetty9 · debian · 12

[Debian 13 (Trixie)]

[jetty9]Unknown
Details (4)
- 9.4.57-1.1~deb13u1 · all · trixie
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
[libjetty9-extra-java]Unknown
Source package: [jetty9]
Details (4)
- 9.4.57-1.1~deb13u1 · all · trixie
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
[libjetty9-java]Unknown
Source package: [jetty9]
Details (4)
- 9.4.57-1.1~deb13u1 · all · trixie
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13
- 9.4.57-1.1~deb13u1 · all · trixie-security
  Fixed · Fixed: 9.4.57-1
  dsa · jetty9 · debian · 13

[openSUSE Tumbleweed]

[jetty-annotations]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-ant]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-cdi]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-client]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-continuation]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-deploy]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-fcgi]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-http]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-http-spi]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-io]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-jaas]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-jaspi]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-jmx]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed
[jetty-jndi]Unknown
Source package: [jetty-minimal]
Details (1)
- 9.4.58-5.1 · noarch · tumbleweed
  Unknown · Fixed: 9.4.57-1.1
  Version impact unknown
  dsa · jetty-minimal · opensuse · tumbleweed

Next results

Observed: Oct 24, 2026, 11:22:53 PM UTC

References

[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]