CVE-2019-17632 Unescaped exception messages in error responses in Jetty

What is CVE-2019-17632?

CVE-2019-17632 is a medium-severity cross-site scripting vulnerability in Eclipse Jetty, published on 25 Nov 2019. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.

Official description

In Eclipse Jetty versions 9.4.21.v20190926, 9.4.22.v20191022, and 9.4.23.v20191118, the generation of default unhandled Error response content (in text/html and text/json Content-Type) does not escape Exception messages in stacktraces included in error output.

Weakness: CWE-79

Which versions are affected by CVE-2019-17632?

6 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 1 product.

Products include Eclipse Jetty.

How do I fix CVE-2019-17632?

Upgrade org.eclipse.jetty:jetty-server to 9.4.24.v20191120 or later.

Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.

Is CVE-2019-17632 being exploited?

There is no known exploitation of CVE-2019-17632 in the wild and no public exploit code.

Other vulnerabilities in Eclipse Jetty

• CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request Critical 9.8
• CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server Critical 9.4
• CVE-2018-12538 Access and integrity issue within Eclipse Jetty High 8.8
• CVE-2026-10050 Digest authentication lossy encoding High 8.7
• CVE-2025-5115 MadeYouReset HTTP/2 vulnerability High 7.7

All Eclipse Jetty vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as DEBIAN-CVE-2019-17632, GHSA-5h9j-q6j2-253f, UBUNTU-CVE-2019-17632.