Technical impact
A bug in Eclipse Jetty allows a buffer leak when the server reads a request body that may return zero bytes. The leak occurs during normal body processing, such as during the 100‑Continue handshake or when an incoming connection is slow. Each missed read can cause the framework to allocate memory that is never freed, gradually consuming available heap. If the leak persists, an attacker could trigger repeated empty body reads to exhaust system memory, leading to application crashes or degraded performance that effectively denies legitimate users access. This flaw corresponds to CWE-400 (Resource Exhaustion) and CWE-401 (Memory Leak).
Affected Systems
Eclipse Jetty, the open‑source HTTP server and servlet container maintained by the Eclipse Foundation, is affected. No specific version range is listed in the CNA data, so all releases that run the vulnerable body parsing code must be considered at risk until a patch is released.
Risk and Exploitability
The vulnerability carries a CVSS score of 7.5, indicating high severity, but its EPSS score is below 1%, suggesting it is not commonly exploited in the wild at this time. The issue is not included in CISA’s KEV catalog. The attack vector is inferred to be network-based, requiring the attacker to send malicious HTTP requests to a Jetty instance. Since the exploit exploits a legitimate protocol feature, detection may be challenging without monitoring numeric memory consumption. The low EPSS indicates that, the high impact warrants vigilance.
Github GHSA