CVE-2024-8184: Jetty ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
Impact Remote DOS attack can cause out of memory
Description There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
Affected Versions
Jetty 12.0.0-12.0.8 (Supported) Jetty 11.0.0-11.0.23 (EOL) Jetty 10.0.0-10.0.23 (EOL) Jetty 9.3.12-9.4.55 (EOL)
Patched Versions
Jetty 12.0.9 Jetty 11.0.24 Jetty 10.0.24 Jetty 9.4.56
Workarounds
Do not use ThreadLimitHandler. Consider use of QoSHandler instead to artificially limit resource utilization.
References
Jetty 12 - https://github.com/jetty/jetty.project/pull/11723
Other sources
Eclipse Jetty is vulnerable to a denial of service, caused by an out of memory flaw in the ThreadLimitHandler.getRemote() function. By sending specially crafted requests, a remote attacker could exploit this vulnerability to exhaust the server memory and results in a denial of service condition.
— IBM
There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.
— MITRE
Affected Software
Remediation
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-8184?
CVE-2024-8184 is a critical vulnerability that enables a remote denial-of-service attack.
How do I fix CVE-2024-8184?
To fix CVE-2024-8184, upgrade to Jetty version 9.4.56, 10.0.24, 11.0.24, or 12.0.9.
Which versions of Jetty are affected by CVE-2024-8184?
CVE-2024-8184 affects Jetty versions from 9.3.12 through 9.4.55, 10.0.0 through 10.0.23, 11.0.0 through 11.0.23, and 12.0.0 through 12.0.8.
What type of attack does CVE-2024-8184 allow?
CVE-2024-8184 allows an attacker to conduct a remote denial-of-service (DoS) attack.
Who can exploit CVE-2024-8184?
CVE-2024-8184 can be exploited by unauthorized users sending crafted requests.