CVE-2015-2080 Jetty vulnerable to exposure of sensitive information to unauthenticated remote users
Remote attackers can obtain sensitive process memory information via illegal characters in HTTP headers, affecting Jetty web server deployments.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2015-2080?
CVE-2015-2080 is a high-severity vulnerability in Eclipse Jetty, published on 7 Oct 2016. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.
Weakness: CWE-200
Which versions are affected by CVE-2015-2080?
2 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-server Maven | All versions | 9.2.9.v20150224 |
org.eclipse.jetty:jetty-server Maven | All versions | 9.2.9.v20150224 |
Products include Eclipse Jetty, Fedoraproject Fedora.
How do I fix CVE-2015-2080?
Upgrade org.eclipse.jetty:jetty-server to 9.2.9.v20150224 or later.
Is CVE-2015-2080 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2015-2080 exists.
Public exploit code: 1 Exploit-DB entry and 1 Nuclei template.
Other vulnerabilities in Eclipse Jetty
- CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
- CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server
- CVE-2018-12538 Access and integrity issue within Eclipse Jetty
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2025-5115 MadeYouReset HTTP/2 vulnerability
Sources
Also known as GHSA-ghgj-3xqr-6jfm.