{"id":"CVE-2024-7708","title":"For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.","summary":"For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.","severity":"high","cvss":7.5,"cvssVector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","cwe":["CWE-400","CWE-401"],"vendor":"eclipse","product":"jetty","affected":["jetty >= 10.0.7, < 10.0.23","jetty >= 11.0.7, < 11.0.23"],"patched":["jetty 11.0.23"],"published":"2026-07-14","updated":"2026-10-02","sourceUpdated":"2026-10-02T00:10:00.180","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2024-7708","references":[{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29","label":"emo@eclipse.org"},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-9299-c6m4-mjhc"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-7708"},{"url":"https://github.com/jetty/jetty.project/pull/12156"},{"url":"https://github.com/jetty/jetty.project/commit/8259eabbc70ae7fc2d525f1e95b43fbdfd2ad097"},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.23"},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.23"},{"url":"https://github.com/advisories/GHSA-9299-c6m4-mjhc"}],"tags":["nvd","ghsa","maven"],"epss":0.0044,"epssPercentile":0.38089,"aliases":["GHSA-9299-c6m4-mjhc"],"ecosystem":"maven","ingestedAt":"2026-07-22T23:07:32.330Z","slug":"CVE-2024-7708","body":"## Overview\n\nFor requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.\nThis is particularly the case for 100-Continue, but any request where the network is slow can leak.\n\n## Affected\n\n- `jetty >= 10.0.7, < 10.0.23`\n- `jetty >= 11.0.7, < 11.0.23`\n\n## Remediation\n\nUpgrade past the affected range:\n\n- `jetty 11.0.23`\n\n## Package advisory (CVE-2024-7708)\n\nAffected packages:\n\n- `org.eclipse.jetty:jetty-server >= 10.0.7, < 10.0.23`\n- `org.eclipse.jetty:jetty-server >= 11.0.7, < 11.0.23`\n\nPatched in:\n\n- `org.eclipse.jetty:jetty-server 10.0.23`\n- `org.eclipse.jetty:jetty-server 11.0.23`\n\nSource: https://github.com/advisories/GHSA-9299-c6m4-mjhc","depth":"twilight","depthScore":41,"depthScoreParts":{"impact":41.3,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}