CVE-2024-6762: Jetty PushSessionCacheFilter can cause remote DoS attacks
Impact Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.
Patches https://github.com/jetty/jetty.project/pull/9715 https://github.com/jetty/jetty.project/pull/9716
Workarounds The session usage is intrinsic to the design of the PushCacheFilter. The issue can be avoided by: + not using the PushCacheFilter. Push has been deprecated by the various IETF specs and early hints responses should be used instead. + reducing the reducing the idle timeout on unauthenticated sessions will reduce the time such session stay in memory. + configuring a session cache to use session passivation, so that sessions are not stored in memory, but rather in a database or file system that may have significantly more capacity than memory.
References https://github.com/jetty/jetty.project/pull/10756 https://github.com/jetty/jetty.project/pull/10755
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2024-6762?
CVE-2024-6762 is rated as a high severity vulnerability due to its potential to allow unauthenticated users to perform remote denial-of-service attacks by exhausting server memory.
How do I fix CVE-2024-6762?
To remediate CVE-2024-6762, update to Jetty version 12.0.4, 11.0.18, or 10.0.18, as applicable.
What applications are affected by CVE-2024-6762?
CVE-2024-6762 affects Eclipse Jetty versions prior to 12.0.4, 11.0.18, and 10.0.18.
What is the impact of CVE-2024-6762?
The impact of CVE-2024-6762 includes the ability for attackers to launch remote DoS attacks on servers running vulnerable Jetty versions.
Are there any workarounds for CVE-2024-6762?
Currently, implementing the available patches is the primary method for mitigating CVE-2024-6762, and no specific workarounds are detailed in the advisory.