CVE-2024-7708: Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
The original report:
Server handling of 100-Continue requests can lead to memory leak that can be abused to cause a Denial of Service state.
After investigation, turns out that every request that has a body, but reading the body may end up in reading 0 bytes, leaks a buffer. This is particularly the case for 100-Continue, but any request where the network is slow can leak.
References
- github.com/advisories/GHSA-9299-c6m4-mjhc
- github.com/jetty/jetty.project/commit/8259eabbc70ae7fc2d525f1e95b43fbdfd2ad097
- github.com/jetty/jetty.project/pull/12156
- github.com/jetty/jetty.project/releases/tag/jetty-10.0.23
- github.com/jetty/jetty.project/releases/tag/jetty-11.0.23
- github.com/jetty/jetty.project/security/advisories/GHSA-9299-c6m4-mjhc
- gitlab.eclipse.org/security/cve-assignment/-/work_items/29
- nvd.nist.gov/vuln/detail/CVE-2024-7708
Code Behaviors & Features
Detect and mitigate CVE-2024-7708 with GitLab Dependency Scanning
Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →