CVE-2024-13009 Eclipse Jetty GZIP buffer release
Attackers can read sensitive data from other requests due to buffer corruption during GZIP inflation in Eclipse Jetty.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2024-13009?
CVE-2024-13009 is a high-severity vulnerability in Eclipse Jetty, published on 8 May 2025. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
Weakness: CWE-404
Which versions are affected by CVE-2024-13009?
2 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.57.v20241219 |
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.57.v20241219 |
Linux distribution packages (2)
puppetserver Red Hat:satellite:6.15::el8 | All versions | 0:7.17.3.1-1.el8sat |
puppetserver Red Hat:satellite_capsule:6.15::el8 | All versions | 0:7.17.3.1-1.el8sat |
Products include Eclipse Jetty.
How do I fix CVE-2024-13009?
Upgrade org.eclipse.jetty:jetty-server to 9.4.57.v20241219 or later.
Is CVE-2024-13009 being exploited?
There is no known exploitation of CVE-2024-13009 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Jetty
- CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
- CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server
- CVE-2018-12538 Access and integrity issue within Eclipse Jetty
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2025-5115 MadeYouReset HTTP/2 vulnerability
Sources
Also known as CLEANSTART-2026-JN51760, CLEANSTART-2026-RH70796, CLEANSTART-2026-XS63603, CLSA-2025-1764547660, DEBIAN-CVE-2024-13009, ECHO-a2ec-e9e1-3f35 and 6 more.