CVE-2024-6763

Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL parsing. The HttpURI class does insufficient validation on the authority segment of a URI. However the behaviour of HttpURI differs from the common browsers in how it handles a URI that would be considered invalid if fully validated against the RRC. Specifically HttpURI and the browser may differ on the value of the host extracted from an invalid URI and thus a combination of Jetty and a vulnerable browser may be vulnerable to a open redirect attack or to a SSRF attack if the URI is used after passing validation checks.

• CWE-1286

• https://github.com/jetty/jetty.project/pull/12012Patch, Third Party Advisory
• https://github.com/jetty/jetty.project/security/advisories/GHSA-qh8g-58pp-2wxhExploit, Mitigation, Vendor Advisory
• https://gitlab.eclipse.org/security/cve-assignement/-/issues/25Vendor Advisory
• https://security.netapp.com/advisory/ntap-20250306-0005/Third Party Advisory

Published

Oct 14, 2024

Last Modified

Jun 17, 2026

Status

Analyzed

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2024-6757The Elementor Website Builder – More than Just a Page Builde…4.3
• CVE-2024-6758Improper Privilege Management in Sprecher Automation SPRECON…6.5
• CVE-2024-6759When mounting a remote filesystem using NFS, the kernel did …5.3
• CVE-2024-6760A logic bug in the code which disables kernel tracing for se…7.5
• CVE-2024-6761Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-6762Jetty PushSessionCacheFilter can be exploited by unauthentic…6.5
• CVE-2024-6765Rejected reason: This CVE ID has been rejected or withdrawn …
• CVE-2024-6766The shortcodes-ultimate-pro WordPress plugin before 7.2.1 do…5.4
• CVE-2024-6767The WordSurvey plugin for WordPress is vulnerable to Stored …5.5
• CVE-2024-6768A Denial of Service in CLFS.sys in Microsoft Windows 10, Win…6.8
• CVE-2024-6769A DLL Hijacking caused by drive remapping combined with a po…8.4
• CVE-2024-6770The Lifetime free Drag & Drop Contact Form Builder for WordP…7.2