CVE-2024-7708 PUBLISHED

Assigner: eclipse
Reserved: 12.08.2024 Published: 14.07.2026 Updated: 14.07.2026

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak. This is particularly the case for 100-Continue, but any request where the network is slow can leak.

Metrics

CVSS 3.1

CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS Score: 7.5

Attack Vector	Network	Scope	Unchanged
Attack Complexity	Low	Confidentiality Impact	None
Privileges Required	None	Integrity Impact	None
User Interaction	None	Availability Impact	High

CVSS 3.1

Product Status

Vendor	Eclipse Foundation
Product	Eclipse Jetty
Versions	Default: unaffected affected from 10.0.7 to 10.0.23 (excl.) affected from 11.0.7 to 11.0.23 (excl.)

Credits

https://github.com/kimmerin finder
https://github.com/pmneo finder

References

https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29

Problem Types

CWE-400 CWE
CWE-401 CWE