CVE-2015-2080

Severity: high (CVSS 7.5 v3.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 75.4% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2016-10-07 · updated 2026-06-17
Weakness: CWE-200

Description

The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process memory via illegal characters in an HTTP header, aka JetLeak.

Affected products

The Eclipse Foundation Eclipse Jetty: 9.2.3, 9.2.4, 9.2.5, 9.2.6, 9.2.7, 9.2.8 (+2)
Fedoraproject Fedora: 22

References

http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00075.html
http://lists.fedoraproject.org/pipermail/package-announce/2015-March/151804.html
http://packetstormsecurity.com/files/130567/Jetty-9.2.8-Shared-Buffer-Leakage.html
http://seclists.org/fulldisclosure/2015/Mar/12
http://www.securityfocus.com/archive/1/534755/100/1600/threaded
http://www.securityfocus.com/bid/72768
http://www.securitytracker.com/id/1031800
https://blog.gdssecurity.com/labs/2015/2/25/jetleak-vulnerability-remote-leakage-of-shared-buffers-in-je.html
https://github.com/eclipse/jetty.project/blob/jetty-9.2.x/advisories/2015-02-24-httpparser-error-buffer-bleed.md
https://security.netapp.com/advisory/ntap-20190307-0005/
http://dev.eclipse.org/mhonarc/lists/jetty-announce/msg00074.html

Get alerted when CVE-2015-2080 or the next vulnerability affects your stack