CVE-2024-6762 in Jetty
Summary
by MITRE • 10/14/2024
Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.
Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Analysis
by VulDB Data Team • 01/29/2026
The CVE-2024-6762 vulnerability affects the Jetty PushSessionCacheFilter component, which is part of the Eclipse Jetty web server framework widely used for hosting web applications. This security flaw represents a critical remote denial of service vulnerability that can be exploited by unauthenticated attackers to consume excessive server memory resources. The vulnerability specifically targets the session cache management functionality within Jetty's push mechanism, creating a pathway for malicious actors to systematically deplete available memory resources without requiring any authentication credentials. The affected component operates within the HTTP/2 push functionality that allows servers to proactively send resources to clients, but the session cache filter fails to properly validate or limit the number of concurrent sessions that can be cached, leading to uncontrolled memory consumption.
The technical exploitation of this vulnerability occurs through the manipulation of HTTP/2 push session cache behavior within the Jetty server implementation. When an attacker sends specially crafted requests that trigger the push session cache mechanism, the system creates and maintains session entries without adequate bounds checking or resource limiting. This allows for a memory exhaustion attack where the cache grows indefinitely until the server runs out of available memory resources, causing the application to crash or become unresponsive. The vulnerability stems from insufficient input validation and lack of proper resource management within the session cache filter, which does not implement adequate safeguards against maliciously constructed requests that could trigger continuous cache growth. The flaw is particularly dangerous because it operates at the server infrastructure level where memory exhaustion can lead to complete service disruption.
The operational impact of CVE-2024-6762 extends beyond simple service interruption to encompass potential business continuity risks and resource exhaustion attacks that can affect entire server clusters. Organizations running Jetty-based applications are vulnerable to remote attackers who can consume system resources without authentication, potentially leading to cascading failures in web applications that depend on the affected server infrastructure. The vulnerability affects systems where HTTP/2 push functionality is enabled and where session caching is utilized, making it particularly relevant for high-traffic web applications and microservices architectures that leverage Jetty's advanced HTTP features. Attackers can leverage this vulnerability to perform resource exhaustion attacks that may not be immediately obvious, as the memory consumption occurs gradually and can go unnoticed until the system becomes completely unresponsive.
Mitigation strategies for this vulnerability require immediate attention from system administrators and security teams responsible for maintaining Jetty-based web applications. The primary recommendation involves applying the latest security patches and updates from the Eclipse Jetty project, which should address the session cache validation issues and implement proper resource limits. Organizations should also consider implementing rate limiting and connection throttling mechanisms to prevent abuse of the HTTP/2 push functionality, along with monitoring systems that can detect unusual memory consumption patterns. Additionally, security teams should review their current deployment configurations to disable HTTP/2 push functionality if it is not essential for their applications, as this can serve as a temporary workaround while permanent patches are applied. The vulnerability aligns with CWE-400 which addresses improper resource management and CWE-770 which covers allocation of resources without limits, while also mapping to ATT&CK technique T1499.004 for resource exhaustion attacks that target memory availability. Organizations should also implement network-level protections such as firewalls and intrusion detection systems to monitor for patterns consistent with this specific attack vector and establish automated alerting for abnormal resource consumption that could indicate exploitation attempts.