CVE-2004-2381: Medium severity Jetty Jetty HTTP server vulnerability
Published Dec 31, 2004
·Updated
HttpRequest.java in Jetty HTTP Server before 4.2.19 allows remote attackers to cause denial of service (memory usage and application crash) via HTTP requests with a large Content-Length.
Affected Software
68 affected componentsFixes available
maven/org.mortbay.jetty:jetty<4.2.19
4.2.19
Jetty Jetty HTTP server=4.0.0
Jetty Jetty HTTP server=4.0.1
Jetty Jetty HTTP server=4.0.1_rc0
Jetty Jetty HTTP server=4.0.1_rc1
Jetty Jetty HTTP server=4.0.1_rc2
Jetty Jetty HTTP server=4.0.2
Jetty Jetty HTTP server=4.0.3
Jetty Jetty HTTP server=4.0.4
Jetty Jetty HTTP server=4.0.5
Jetty Jetty HTTP server=4.0.6
Jetty Jetty HTTP server=4.0.b0
Jetty Jetty HTTP server=4.0.b1
Jetty Jetty HTTP server=4.0.b2
Jetty Jetty HTTP server=4.0.d0
Jetty Jetty HTTP server=4.0.d1
Jetty Jetty HTTP server=4.0.d2
Jetty Jetty HTTP server=4.0.d3
Jetty Jetty HTTP server=4.0.d4
Jetty Jetty HTTP server=4.0_rc1
Jetty Jetty HTTP server=4.0_rc2
Jetty Jetty HTTP server=4.0_rc3
Jetty Jetty HTTP server=4.1.0
Jetty Jetty HTTP server=4.1.0_rc0
Jetty Jetty HTTP server=4.1.0_rc1
Jetty Jetty HTTP server=4.1.0_rc2
Jetty Jetty HTTP server=4.1.0_rc3
Jetty Jetty HTTP server=4.1.0_rc4
Jetty Jetty HTTP server=4.1.0_rc5
Jetty Jetty HTTP server=4.1.0_rc6
Jetty Jetty HTTP server=4.1.1
Jetty Jetty HTTP server=4.1.2
Jetty Jetty HTTP server=4.1.3
Jetty Jetty HTTP server=4.1.4
Jetty Jetty HTTP server=4.1.b0
Jetty Jetty HTTP server=4.1.b1
Jetty Jetty HTTP server=4.1.d0
Jetty Jetty HTTP server=4.1.d1
Jetty Jetty HTTP server=4.1.d2
Jetty Jetty HTTP server=4.2.0
Jetty Jetty HTTP server=4.2.0_beta0
Jetty Jetty HTTP server=4.2.0_rc0
Jetty Jetty HTTP server=4.2.0_rc1
Jetty Jetty HTTP server=4.2.1
Jetty Jetty HTTP server=4.2.2
Jetty Jetty HTTP server=4.2.3
Jetty Jetty HTTP server=4.2.4
Jetty Jetty HTTP server=4.2.4_rc0
Jetty Jetty HTTP server=4.2.5
Jetty Jetty HTTP server=4.2.6
Jetty Jetty HTTP server=4.2.7
Jetty Jetty HTTP server=4.2.8_01
Jetty Jetty HTTP server=4.2.9
Jetty Jetty HTTP server=4.2.9_rc1
Jetty Jetty HTTP server=4.2.9_rc2
Jetty Jetty HTTP server=4.2.10
Jetty Jetty HTTP server=4.2.10_pre0
Jetty Jetty HTTP server=4.2.10_pre1
Jetty Jetty HTTP server=4.2.11
Jetty Jetty HTTP server=4.2.12
Jetty Jetty HTTP server=4.2.14
Jetty Jetty HTTP server=4.2.14_rc0
Jetty Jetty HTTP server=4.2.14_rc1
Jetty Jetty HTTP server=4.2.15
Jetty Jetty HTTP server=4.2.15_rc0
Jetty Jetty HTTP server=4.2.16
Jetty Jetty HTTP server=4.2.17
Jetty Jetty HTTP server=4.2.18
Remediation
Patch Available
Event History
Dec 31, 2004
CVE Published
05:00 AM
Aug 16, 2005
CVE Published
via MITRE·08:00 AM
Data Sourced
via MITRE·08:00 AM
Description
Apr 29, 2022
Advisory Published
03:01 AM
Frequently Asked Questions
1
What is the severity of CVE-2004-2381?
The severity of CVE-2004-2381 is classified as high due to its potential to cause denial of service.
2
How do I fix CVE-2004-2381?
To fix CVE-2004-2381, upgrade to Jetty HTTP Server version 4.2.19 or later.
3
What exploit can be used with CVE-2004-2381?
CVE-2004-2381 can be exploited by sending HTTP requests with a large Content-Length to the affected server.
4
Which versions of Jetty are affected by CVE-2004-2381?
Jetty HTTP Server versions prior to 4.2.19, including 4.2.18 and earlier, are affected by CVE-2004-2381.
5
What are the potential consequences of CVE-2004-2381?
The potential consequences of CVE-2004-2381 include increased memory usage leading to application crashes and service unavailability.