NVD

CVE-2024-9823 Detail

Description

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST: NVD

N/A

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

NIST: NVD

Base Score: 7.5 HIGH

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Nist CVSS score does not match with CNA score

CNA: Eclipse Foundation

Base Score: 5.3 MEDIUM

Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Base Score: N/A

NVD assessment not yet provided.

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL	Source(s)	Tag(s)
https://github.com/jetty/jetty.project/issues/1256	Eclipse Foundation	Issue Tracking
https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h	Eclipse Foundation	Vendor Advisory
https://gitlab.eclipse.org/security/cve-assignement/-/issues/39	Eclipse Foundation	Issue Tracking Vendor Advisory
https://security.netapp.com/advisory/ntap-20250306-0006/	CVE	Third Party Advisory

Weakness Enumeration

CWE-ID	CWE Name	Source
CWE-400	Uncontrolled Resource Consumption	Eclipse Foundation

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Denotes Vulnerable Software
Are we missing a CPE here? Please let us know.

Change History

4 change records found show changes

Initial Analysis by NIST 7/30/2025 3:51:05 PM

Action	Type	New Value
Added	CVSS V3.1	AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Added	CPE Configuration	AND OR cpe:2.3:o:netapp:bootstrap_os:-::::::: OR cpe:2.3:h:netapp:hci_compute_node:-:::::::*
Added	CPE Configuration	OR cpe:2.3:a:eclipse:jetty::::::::* versions from (including) 10.0.0 up to (excluding) 10.0.18 cpe:2.3:a:eclipse:jetty::::::::* versions from (including) 11.0.0 up to (excluding) 11.0.18 cpe:2.3:a:eclipse:jetty::::::::* versions from (including) 12.0.0 up to (excluding) 12.0.3 cpe:2.3:a:eclipse:jetty::::::::* versions from (including) 9.0.0 up to (excluding) 9.4.54
Added	CPE Configuration	OR cpe:2.3:a:netapp:active_iq_unified_manager:-:::::vmware_vsphere::* cpe:2.3:a:netapp:active_iq_unified_manager:-:::::linux::* cpe:2.3:a:netapp:active_iq_unified_manager:-:::::windows::*
Added	Reference Type	CVE: https://security.netapp.com/advisory/ntap-20250306-0006/ Types: Third Party Advisory
Added	Reference Type	Eclipse Foundation: https://github.com/jetty/jetty.project/issues/1256 Types: Issue Tracking
Added	Reference Type	Eclipse Foundation: https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h Types: Vendor Advisory
Added	Reference Type	Eclipse Foundation: https://gitlab.eclipse.org/security/cve-assignement/-/issues/39 Types: Issue Tracking, Vendor Advisory

CVE Modified by Eclipse Foundation 10/14/2024 12:15:04 PM

Action

Type

Old Value

New Value

Changed

Description

Description
There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized

users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests,

attackers can trigger OutofMemory errors and exhaust the server's memory finally.


Vulnerability details
The Jetty DoSFilter (Denial of Service Filter) is a security filter designed to protect web

applications against certain types of Denial of Service (DoS) attacks and other abusive behavior. It

helps to mitigate excessive resource consumption by limiting the rate at which clients can make

requests to the server.  The DoSFilter monitors and tracks client request patterns, including

request rates, and can take actions such as blocking or delaying requests from clients that exceed

predefined thresholds.  The internal tracking of requests in DoSFilter is the source of this OutOfMemory

condition.


Impact
Users of the DoSFilter may be subject to DoS attacks that 
will ultimately exhaust the memory of the server if they have not 
configured session passivation or an aggressive session inactivation 
timeout.


Patches
The DoSFilter has been patched in all active releases to no longer support the session tracking mode, even if configured.


Patched releases:



  *  9.4.54

  *  10.0.18

  *  11.0.18

  *  12.0.3

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.

New CVE Received from Eclipse Foundation 10/14/2024 11:15:14 AM

Action	Type	New Value
Added	Description	Description There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally. Vulnerability details The Jetty DoSFilter (Denial of Service Filter) is a security filter designed to protect web applications against certain types of Denial of Service (DoS) attacks and other abusive behavior. It helps to mitigate excessive resource consumption by limiting the rate at which clients can make requests to the server. The DoSFilter monitors and tracks client request patterns, including request rates, and can take actions such as blocking or delaying requests from clients that exceed predefined thresholds. The internal tracking of requests in DoSFilter is the source of this OutOfMemory condition. Impact Users of the DoSFilter may be subject to DoS attacks that will ultimately exhaust the memory of the server if they have not configured session passivation or an aggressive session inactivation timeout. Patches The DoSFilter has been patched in all active releases to no longer support the session tracking mode, even if configured. Patched releases: * 9.4.54 * 10.0.18 * 11.0.18 * 12.0.3
Added	CVSS V3.1	Eclipse Foundation AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Added	CWE	Eclipse Foundation CWE-400
Added	Reference	Eclipse Foundation https://github.com/jetty/jetty.project/issues/1256 [No types assigned]
Added	Reference	Eclipse Foundation https://github.com/jetty/jetty.project/security/advisories/GHSA-7hcf-ppf8-5w5h [No types assigned]
Added	Reference	Eclipse Foundation https://gitlab.eclipse.org/security/cve-assignement/-/issues/39 [No types assigned]

Quick Info

CVE Dictionary Entry:
CVE-2024-9823
NVD Published Date:
10/14/2024
NVD Last Modified:
07/30/2025
Source:
Eclipse Foundation

You are viewing this page in an unauthorized frame window.

Information Technology Laboratory

National Vulnerability Database

National Vulnerability Database

CVE-2024-9823 Detail

Description

Metrics

References to Advisories, Solutions, and Tools

Weakness Enumeration

Known Affected Software Configurations Switch to CPE 2.2

CPEs loading, please wait.

Change History

Initial Analysis by NIST 7/30/2025 3:51:05 PM

CVE Modified by CVE 3/06/2025 8:15:11 PM

CVE Modified by Eclipse Foundation 10/14/2024 12:15:04 PM

New CVE Received from Eclipse Foundation 10/14/2024 11:15:14 AM

Quick Info