CVE-2024-7708CWE-400CWE-401denial-of-service

CVE-2024-7708

High · published July 14, 2026

CVSS v3.1
7.5
EPSS
0%
Percentile
37.2
In the wild
Unconfirmed
What it is

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.

This is particularly the case for 100-Continue, but any request where the network is slow can leak.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.00440 · 37.2th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-401 · Missing Release of Memory after Effective Lifetime
Published
2026-07-14T13:16Z
Affected products (2)
ProductVersionsFixed in
eclipse/jetty≥ 10.0.7, < 10.0.2310.0.23
eclipse/jetty≥ 11.0.7, < 11.0.2311.0.23
References (1)
https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29 · [email protected]
EPSS history
Timeline
  • 14 JUL 09:01Z
    For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak
    cvelistv5