Security context

What an agent needs to avoid regressing past fixes and find the next vuln in this repo.

jetty/jetty.project

              jetty-12.1.x @ 2b1da8a
            

Fixes

CVEs

CRITICAL

Peak severity

Highlights

Denial of Service: 4 prior fixes. Scrutinize any change in this area.

jetty-core: most-fixed (3 issues). Treat as high-risk during review.

0 high-severity fixes in this history; regressions here are high-impact.

Recurring patterns

The bug types that recur here, drawn from past fixes, not open vulnerabilities.

Denial of Service: Thread starvation, thread-hangs, or resource leaks during connection upgrades and protocol negotiation can crash the server, requiring robust default blocking configurations and minimum rate handlers.

Auth Bypass: Inconsistencies between the parsed HTTP request authority and the Host header allow request routing discrepancies and request smuggling bypasses. Ensure validation occurs after request customization.

Denial of Service: Improperly bounded integer accumulation and parsing of chunk sizes or extensions can lead to CPU/memory exhaustion or integer overflow, bypassable via malformed chunk streams.