Eclipse Jetty: Mehrere Schwachstellen ermöglichen Denial of Service
WID-SEC-2023-2627 · first 11.10.2023 · updated 06.07.2026 · CVSS 7,5
What it is about
Eclipse Jetty ist ein Java-HTTP-Server und Java-Servlet-Container. Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um einen Denial of Service Angriff durchzuführen.
Under what conditions?
Over the network and without logging in. This is the most dangerous combination: attackers can scan reachable devices automatically.
What can happen in the worst case
An attacker could use the vulnerability to
- einen Denial of Service Angriff durchzuführen
Am I affected?
Affected according to the BSI:
- IBM Security Guardium 11.3
- Eclipse Jetty <10.0.16
- Eclipse Jetty <11.0.16
- Debian Linux
- IBM Maximo Asset Management 7.6.1
- IBM Security Guardium 10.6
- IBM InfoSphere Information Server 11.7
- Red Hat Enterprise Linux
- SUSE Linux
- IBM Integration Bus
- IBM SPSS Modeler
- IBM QRadar SIEM 7.5
and 16 more
The installed version is usually shown under “Help → About” or in the device’s admin interface.
What helps?
Update to at least:
- Eclipse Jetty 10.0.16
- Eclipse Jetty 11.0.16
- Eclipse Jetty 9.4.53
- Eclipse Jetty 10.0.17
- Eclipse Jetty 11.0.17
- Eclipse Jetty 12.0.2
- Dell NetWorker vProxy19.9.0.4
- Dell NetWorker vProxy19.10
- Atlassian Confluence 8.5.7
- Atlassian Confluence 7.19.20
- Atlassian Confluence 8.8.1
- IBM Rational Change 5.3.2.7
Is the vulnerability already being exploited?
- CVE-2023-44487: exploited in the wild according to CISA, in the catalogue since 10.10.2023.
- According to a CISA advisory, used by actors from : 2023 Top Routinely Exploited Vulnerabilities (11/2024)
Information and sources
- Original BSI advisory (WID)
- Eclipse Jetty Releases vom 2023-10-10 www.eclipse.org
- SUSE Security Update SUSE-SU-2023:4210-1 vom 2023-10-26 lists.suse.com
- Debian Security Advisory DLA-3641 vom 2023-10-30 lists.debian.org
- Debian Security Advisory DSA-5540 vom 2023-10-30 lists.debian.org
- IBM Security Bulletin 7076824 vom 2023-11-15 www.ibm.com
- Red Hat Security Advisory RHSA-2023:7247 vom 2023-11-16 access.redhat.com
- Debian Security Advisory DLA-3656 vom 2023-11-19 lists.debian.org
- IBM Security Bulletin 7070763 vom 2023-11-29 www.ibm.com
- IBM Security Bulletin 7099297 vom 2023-12-18 www.ibm.com
- Atlassian Security Advisory CONFSERVER-93826 vom 2024-01-03 jira.atlassian.com
- IBM Security Bulletin 7108700 vom 2024-01-17 www.ibm.com
- DELL Security Update www.dell.com
- Atlassian Security Advisory jira.atlassian.com
- IBM Security Bulletin 7152890 vom 2024-05-16 www.ibm.com
- Red Hat Security Advisory RHSA-2024:3354 vom 2024-05-24 access.redhat.com
- IBM Security Bulletin 7172226 vom 2024-10-04 www.ibm.com
- openSUSE Security Update OPENSUSE-SU-2024:14442-1 vom 2024-10-31 lists.opensuse.org
- Hitachi Vulnerability Information HITACHI-SEC-2024-150 vom 2024-12-17 www.hitachi.com
- IBM Security Bulletin 7229444 vom 2025-03-28 www.ibm.com
- IBM Security Bulletin 7231640 vom 2025-04-23 www.ibm.com
- Dell Security Advisory DSA-2026-152 vom 2026-03-23 www.dell.com
- IBM Security Bulletin 7279060 vom 2026-07-03 www.ibm.com
CVE: CVE-2023-36478, CVE-2023-44487
Source: BSI warning and information service (CERT-Bund); CISA. The assessment of the conditions is my reading of the BSI text; the external pages are in their original language.