CVE-2024-13009: eclipse foundation jetty Improper Resource Shutdown or Release
CVSS: 7.2v3.1HighAnalyzed
AliasesRHSA-2025:15643UBUNTU-CVE-2024-13009DEBIAN-CVE-2024-13009CGA-552x-pffc-g64hCGA-m4mc-vhmw-xmc5CGA-w3g5-g2p6-xx8xCGA-x443-76c5-9h34CGA-4ghc-vwcp-r3wrCGA-844p-3gjx-9fqwCGA-8gg4-g6q8-5j7mCGA-ccw9-3vhx-896pCGA-gp3w-r4vv-frp6CGA-gxvc-q77w-h9xxCGA-mmmv-249r-f6c8GHSA-q4rv-gq96-w7c5CGA-rxhq-w5g3-9f69CGA-vj2x-73q3-2xwhCGA-x357-75m3-69hq
Published 08-05-2025Last modified 08-05-2025
Vulnerability summary
CVE-2024-13009 is a high (CVSS 7.2) Improper Resource Shutdown or Release vulnerability in eclipse foundation jetty. EPSS estimates a 0.55% chance of exploitation in the next 30 days, higher than 44.7% of scored vulnerabilities.
CVSS score
7.2/10
010
High · v3.1 (CVE.org)EPSS score
0.55%
0%100%
Low · +0.02 pp in 30 daysKEVNot listedIn no KEV catalog
RansomwareNone recordedNo known use recorded
Public exploits0No public exploits recorded
Advisory lineage
Upstream 0 · Downstream 4 · Related 5Timeline
- 08-05-2025PublishedVulnerability first disclosed.
- 08-05-2025Last modifiedVulnerability information updated.
Description
In Eclipse Jetty versions 9.4.0 to 9.4.56 a buffer can be incorrectly released when confronted with a gzip error when inflating a request body. This can result in corrupted and/or inadvertent sharing of data between requests.
CVSS metrics
8 scores · 8 sources · 1 versionHigh 7.2Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:NSourcesAll 8 agree
- OSV · Red hatEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- OSV · UbuntuEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- OSV · DebianEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- OSV · WolfiEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- OSV · ChainguardEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- OSV · MavenEcosystem advisory · calculated7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
- NVDNIST7.2HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:L/I:L/A:N
EPSS trend
Probability
0.55%
Chance of exploitation in the next 30 days
Percentile
45%
Versus all other CVEs
30-day change
+0.02 pp
From 0.53% on 18-09-2026
18-09-202618-10-2026
EPSS score0.55%
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Chainguard7 products
- cassandra-reaper< 3.8.0-r3
- celeborn-0.5< 0.5.4-r26
- cruise-control-fips-jarsAll versions (No fix recorded)
- cruise-control-jarsAll versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
Wolfi2 products
- cassandra-reaper< 3.8.0-r3
- tezAll versions (No fix recorded)
Debian1 product
- jetty9< 9.4.57-0+deb12u1 | < 9.4.57-1
Eclipse1 product
- jetty≥ 9.4.0, < 9.4.57
Eclipse foundation1 product
- jetty≥ 9.4.0, ≤ 9.4.56
Org.eclipse.jetty1 product
- jetty-server≥ 9.4.0, < 9.4.57.v20241219
Redhat1 product
- puppetserver< 0:7.17.3.1-1.el8sat
Ubuntu1 product
- jetty9All versions (No fix recorded)
8 vendors · 15 products
References
13 links- github.com/jetty/jetty.project/security/advisories/GHSA-q4rv-gq96-w7c5ARTICLEREPORTAdvisoryWEBVendor Advisory
