CVE-2024-7708: Resource Exhaustion via HTTP Connection Buffer Leak in Eclipse Jetty

Vulnerability ID: CVE-2024-7708
CVSS Score: 7.5
Published: 2026-07-22

Eclipse Jetty is subject to an uncontrolled resource consumption vulnerability in its HTTP connection handling component. When processing certain HTTP request sequences, such as those invoking the Expect: 100-Continue handshake under specific network constraints, the server fails to return allocated buffers to its central pool. Over time, this leads to buffer pool exhaustion and a complete denial of service via memory starvation.

TL;DR

Unauthenticated remote attackers can trigger a heap memory leak in Eclipse Jetty by sending requests that yield zero-byte reads (e.g., Expect: 100-Continue handshakes resulting in early 404 responses). Over repeated connections, this exhausts the RetainableByteBufferPool, leading to an OutOfMemoryError and service crash.

⚠️ Exploit Status: POC

Technical Details

• CWE ID: CWE-400, CWE-401
• Attack Vector: Network (AV:N)
• CVSS Severity: 7.5 (High)
• EPSS Score: 0.00252
• Impact: Denial of Service (DoS)
• Exploit Status: Proof of Concept (PoC) available
• CISA KEV Status: Not Listed

Affected Systems

• Eclipse Jetty 10.x (versions >= 10.0.7 and < 10.0.23)
• Eclipse Jetty 11.x (versions >= 11.0.7 and < 11.0.23)
• Jetty: >= 10.0.7, < 10.0.23 (Fixed in: 10.0.23)
• Jetty: >= 11.0.7, < 11.0.23 (Fixed in: 11.0.23)

Code Analysis

Commit: 8259eab

Release request buffer when filled <= 0 and catch Throwable to release on any exception.

Exploit Details

• GitHub (Official Jetty JUnit Test Suite): Integration test HttpClientContinueTest.testExpect100ContinueThen404 replicates buffer leakage behavior.

Mitigation Strategies

• Upgrade Jetty components to the latest patched releases (10.0.23 or 11.0.23).
• Filter or limit incoming HTTP requests containing the Expect: 100-Continue header at the load balancer or reverse proxy level.
• Configure aggressive connection idle timeouts to reclaim sockets and prevent prolonged connection-stalling tactics.

Remediation Steps:

1. Identify all internal deployments and dependencies using jetty-server versions between 10.0.7 and 10.0.22, or 11.0.7 and 11.0.22.
2. Update Maven or Gradle build files to reference Jetty version 10.0.23 or 11.0.23.
3. Rebuild and redeploy the affected services to production environments.
4. Verify the fix by monitoring direct memory pool allocations under synthetic test loads.

References

• NVD Entry for CVE-2024-7708
• CVE.org Record
• GitLab Assignment Tracking Issue
• GitHub Pull Request
• Jetty 10.0.23 Release Notes
• Jetty 11.0.23 Release Notes

Read the full report for CVE-2024-7708 on our website for more details including interactive diagrams and full exploit analysis.