---
id: CVE-2024-7708
title: >-
  For requests that have a body, but reading the body may end up in reading 0
  bytes, there is a buffer leak.

  This is particularly the case for 100-Continue, but any request where the
  network is slow can leak.
summary: >-
  For requests that have a body, but reading the body may end up in reading 0
  bytes, there is a buffer leak.

  This is particularly the case for 100-Continue, but any request where the
  network is slow can leak.
severity: high
cvss: 7.5
cvssVector: 'CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H'
cwe:
  - CWE-400
  - CWE-401
vendor: eclipse
product: jetty
affected:
  - 'jetty >= 10.0.7, < 10.0.23'
  - 'jetty >= 11.0.7, < 11.0.23'
patched:
  - jetty 11.0.23
published: '2026-07-14'
updated: '2026-10-02'
sourceUpdated: '2026-10-02T00:10:00.180'
source: NVD
sourceUrl: 'https://nvd.nist.gov/vuln/detail/CVE-2024-7708'
references:
  - url: 'https://gitlab.eclipse.org/security/cve-assignment/-/work_items/29'
    label: emo@eclipse.org
  - url: >-
      https://github.com/jetty/jetty.project/security/advisories/GHSA-9299-c6m4-mjhc
  - url: 'https://nvd.nist.gov/vuln/detail/CVE-2024-7708'
  - url: 'https://github.com/jetty/jetty.project/pull/12156'
  - url: >-
      https://github.com/jetty/jetty.project/commit/8259eabbc70ae7fc2d525f1e95b43fbdfd2ad097
  - url: 'https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.23'
  - url: 'https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.23'
  - url: 'https://github.com/advisories/GHSA-9299-c6m4-mjhc'
tags:
  - nvd
  - ghsa
  - maven
epss: 0.0044
epssPercentile: 0.38089
aliases:
  - GHSA-9299-c6m4-mjhc
ecosystem: maven
ingestedAt: '2026-07-22T23:07:32.330Z'
---

## Overview

For requests that have a body, but reading the body may end up in reading 0 bytes, there is a buffer leak.
This is particularly the case for 100-Continue, but any request where the network is slow can leak.

## Affected

- `jetty >= 10.0.7, < 10.0.23`
- `jetty >= 11.0.7, < 11.0.23`

## Remediation

Upgrade past the affected range:

- `jetty 11.0.23`

## Package advisory (CVE-2024-7708)

Affected packages:

- `org.eclipse.jetty:jetty-server >= 10.0.7, < 10.0.23`
- `org.eclipse.jetty:jetty-server >= 11.0.7, < 11.0.23`

Patched in:

- `org.eclipse.jetty:jetty-server 10.0.23`
- `org.eclipse.jetty:jetty-server 11.0.23`

Source: https://github.com/advisories/GHSA-9299-c6m4-mjhc