CVE-2024-7708

A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause a denial of service (DoS) by sending specially crafted HTTP requests. Specifically, a buffer leak occurs when processing requests that have a body but read zero bytes, such as 100-Continue requests, or during slow network conditions. This can lead to resource exhaustion and make the server unavailable.

Red Hat's version of Eclipse Jetty (9.0.3) shipped in Red Hat Enterprise Linux 7 is not affected by this vulnerability. The flaw was introduced in Jetty 10.0.0 and affects versions 10.0.0 through 10.0.22 and 11.0.0 through 11.0.22. The shipped version predates the introduction of the vulnerable code.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.