Lian Kee

**Name of the Vulnerable Software and Affected Versions** Jetty (affected versions not specified) **Description** The Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote Denial of Service (DoS) attacks by exhausting the server's memory. This issue allows attackers to remotely attack the server, potentially causing it to run out of memory. **Recommendations** To resolve the issue, consider the following workarounds: * Avoid using the PushCacheFilter, as Push has been deprecated by the various IETF specs and early hints responses should be used instead. * Reduce the idle timeout on unauthenticated sessions to reduce the time such sessions stay in memory. * Configure a session cache to use session passivation, so that sessions are not stored in memory, but rather in a database or file system that may have significantly more capacity than memory. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

**Name of the Vulnerable Software and Affected Versions** Eclipse Jetty versions prior to 9.4.54 Eclipse Jetty versions prior to 10.0.18 Eclipse Jetty versions prior to 11.0.18 Eclipse Jetty versions prior to 12.0.3 **Description** The vulnerability in Jetty's DosFilter can be exploited by unauthorized users to cause a remote denial-of-service (DoS) attack on the server. By repeatedly sending crafted requests, attackers can trigger OutOfMemory errors and exhaust the server's memory. The DoSFilter is designed to protect web applications against certain types of DoS attacks, but its internal tracking of requests is the source of this OutOfMemory condition. Users of the DoSFilter may be subject to DoS attacks that will ultimately exhaust the memory of the server if they have not configured session passivation or an aggressive session inactivation timeout. **Recommendations** For Eclipse Jetty versions prior to 9.4.54, update to version 9.4.54 or later. For Eclipse Jetty versions prior to 10.0.18, update to version 10.0.18 or later. For Eclipse Jetty versions prior to 11.0.18, update to version 11.0.18 or later. For Eclipse Jetty versions prior to 12.0.3, update to version 12.0.3 or later. As a temporary workaround, consider configuring session passivation or an aggressive session inactivation timeout to mitigate the risk of exploitation.