CVE-2024-13009CWE-404

Eclipse Jetty GZIP buffer release

High · published May 8, 2025

CVSS v3.1
7.2
EPSS
1%
Percentile
45.1
In the wild
Unconfirmed
What it is

In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request

body. This can result in corrupted and/or inadvertent sharing of data between requests.

The record
Technical detail
CVSS v3.1
7.2 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
CVSS v4.0
Not supplied
EPSS
0.00548 · 45.1th percentile
Weakness
CWE-404 · Improper Resource Shutdown or Release
Published
2025-05-08T17:29Z
EPSS history
Timeline
  • 08 MAY 17:29Z
    Eclipse Jetty GZIP buffer release
    cvelistv5