CVE-2024-8184
📋 TL;DR
This vulnerability in Jetty's ThreadLimitHandler.getRemote() allows unauthenticated attackers to send crafted requests that trigger OutOfMemory errors, causing denial-of-service by exhausting server memory. Any system running vulnerable Jetty versions with ThreadLimitHandler enabled is affected.
💻 Affected Systems
- Eclipse Jetty
📦 What is this software?
Jetty by Eclipse
Jetty by Eclipse
Jetty by Eclipse
Jetty by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Complete server unavailability due to memory exhaustion, requiring restart and potentially causing extended downtime.
Likely Case
Intermittent service degradation or crashes under attack, affecting application availability.
If Mitigated
Minimal impact with proper memory limits and monitoring in place.
🎯 Exploit Status
Simple crafted request pattern can trigger the issue without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jetty 9.4.56, 10.0.22, 11.0.22
Vendor Advisory: https://github.com/jetty/jetty.project/security/advisories/GHSA-g8m5-722r-8whq
Restart Required: Yes
Instructions:
1. Download patched Jetty version from official repository. 2. Replace vulnerable Jetty JAR files. 3. Restart Jetty server. 4. Verify version with java -jar jetty-home-*.jar --version.
🔧 Temporary Workarounds
Disable ThreadLimitHandler
allRemove or disable ThreadLimitHandler configuration if not required.
Edit jetty.xml or configuration files to remove ThreadLimitHandler references
Implement request rate limiting
linuxUse reverse proxy or WAF to limit request rates per IP.
# Example nginx rate limiting:
limit_req_zone $binary_remote_addr zone=jetty:10m rate=10r/s;
limit_req zone=jetty burst=20 nodelay;
🧯 If You Can't Patch
- Implement strict network segmentation to limit access to Jetty servers
- Deploy WAF with rate limiting and anomaly detection for HTTP requests
🔍 How to Verify
Check if Vulnerable:
Check Jetty version and ThreadLimitHandler configuration in jetty.xml or startup logs.Check Version:
java -jar jetty-home-*.jar --versionVerify Fix Applied:
Verify Jetty version is 9.4.56+, 10.0.22+, or 11.0.22+ and monitor for OutOfMemory errors.📡 Detection & Monitoring
Log Indicators:
- java.lang.OutOfMemoryError in logs
- High memory usage alerts
- ThreadLimitHandler exceptions
Network Indicators:
- Unusual high volume of HTTP requests to Jetty endpoints
- Repeated similar request patterns
SIEM Query:
source="jetty.log" AND ("OutOfMemoryError" OR "java.lang.OutOfMemory")