CVE-2024-6763 in Jetty
Summary
by MITRE • 10/14/2024
Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing.
The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.
Once again VulDB remains the best source for vulnerability data.
Analysis
by VulDB Data Team • 01/29/2026
The vulnerability identified as CVE-2024-6763 resides within the Eclipse Jetty web server and Servlet engine, specifically within its HttpURI utility class responsible for URI/URL parsing operations. This flaw represents a critical security concern that stems from insufficient validation mechanisms applied to the authority segment of URIs, creating potential attack vectors that could be exploited by malicious actors. The HttpURI class serves as a fundamental component in Jetty's processing pipeline, handling all incoming URI requests and parsing them into their constituent parts including scheme, host, port, and path elements. When examining the technical implementation, the vulnerability manifests in the class's deviation from standard URI parsing behavior as defined by RFC specifications, particularly in how it processes malformed or non-compliant URI authority segments.
The operational impact of this vulnerability becomes significant when considering the potential for open redirect attacks and server-side request forgery (SSRF) exploits. The core technical flaw occurs because Jetty's HttpURI implementation does not fully validate URI authority components according to RFC standards, leading to inconsistent behavior between Jetty and modern web browsers when processing malformed URIs. This discrepancy creates a scenario where the host value extracted from an invalid URI by Jetty may differ from what a browser would extract, establishing a potential attack surface for malicious redirection or internal server access. The vulnerability's severity is amplified by the fact that when combined with vulnerable browser behavior, attackers can craft malicious URIs that appear valid to Jetty's parser but contain unexpected host values that could be exploited to redirect users to malicious sites or to make unauthorized requests to internal services.
Security implications extend beyond simple redirection attacks, as this vulnerability could enable sophisticated SSRF attacks where an attacker manipulates URI parsing to bypass security controls and access internal resources. The inconsistency between Jetty's URI parsing and browser behavior creates a dangerous gap in security validation that attackers can exploit to craft requests that pass Jetty's validation checks while still containing malicious payloads. According to CWE classification, this vulnerability aligns with CWE-20: Improper Input Validation, specifically focusing on inadequate validation of URI authority components. The ATT&CK framework categorizes this issue under T1071.004: Application Layer Protocol: DNS and T1566.001: Phishing: Spearphishing Attachment, as it enables both open redirect and SSRF attack vectors. Organizations using Jetty as their web server platform must recognize that this vulnerability represents a fundamental parsing inconsistency that could allow attackers to bypass security controls designed to prevent unauthorized access to internal systems or to redirect users to malicious destinations through carefully crafted URI inputs that exploit the parsing differences between Jetty and standard browser implementations.
Mitigation strategies should focus on implementing comprehensive URI validation at multiple layers of the application stack, including immediate patching of affected Jetty versions and implementing additional validation checks beyond the default HttpURI behavior. Organizations should also consider implementing strict URI parsing policies that enforce RFC compliance across all URI handling components, particularly in applications that process user-supplied URI data. Network-level controls such as firewall rules and proxy configurations can provide additional protection by filtering suspicious URI patterns and monitoring for anomalous redirect behaviors. The recommended approach includes deploying application firewalls that can detect and block malicious URI patterns that exploit the parsing inconsistency, while also implementing comprehensive logging and monitoring to detect potential exploitation attempts. Regular security assessments should verify that all URI parsing components maintain consistent behavior with standard RFC specifications, and that no deviations exist that could create security vulnerabilities similar to those found in CVE-2024-6763.