CVE-2024-7708: 
Jetty vulnerability analysis and mitigation

CVE-2024-7708 is a buffer leak vulnerability in Eclipse Jetty's HTTP request handling that can lead to denial of service. When a request has a body but reading that body results in 0 bytes being read — particularly with HTTP 100-Continue requests or slow network connections — Jetty fails to release the allocated buffer, causing resource exhaustion. The vulnerability affects Eclipse Jetty versions 10.0.7 through 10.0.22 and 11.0.7 through 11.0.22. It carries a CVSS v3.1 base score of 7.5 (High) (Eclipse Security).

The root cause is classified as CWE-400 (Uncontrolled Resource Consumption) and CWE-401 (Missing Release of Memory after Effective Lifetime). When Jetty processes an HTTP request with a declared body but the read operation returns 0 bytes — a condition triggered by HTTP 100-Continue handshakes or slow/stalled network connections — the server fails to properly release the associated buffer back to the pool. This buffer leak accumulates over repeated requests, gradually exhausting server memory. No authentication is required to trigger the condition, and the attack is automatable over the network (Eclipse Security).

Successful exploitation results in progressive memory exhaustion on the affected Jetty server, ultimately causing a denial of service condition. There is no confidentiality or integrity impact — the vulnerability is limited to availability. An unauthenticated remote attacker can repeatedly send crafted HTTP requests with bodies over slow connections or using 100-Continue headers to deplete server buffer resources, rendering the service unavailable to legitimate users (Eclipse Security).

1. Reconnaissance: Identify internet-facing Eclipse Jetty servers running versions 10.0.7–10.0.22 or 11.0.7–11.0.22 using tools like Shodan or Censys by searching for Jetty server banners.
2. Craft HTTP 100-Continue requests: Prepare HTTP requests that include a Content-Length or Transfer-Encoding header indicating a body, along with an Expect: 100-continue header to trigger the 100-Continue handshake.
3. Simulate slow or stalled body delivery: After the server responds with 100 Continue, either send 0 bytes of the body or deliver it extremely slowly, causing Jetty's read operation to return 0 bytes without completing the body read.
4. Repeat at scale: Automate the above requests in high volume to continuously leak buffers without releasing them, progressively exhausting the server's buffer pool.
5. Achieve denial of service: As buffer memory is depleted, the Jetty server becomes unable to process new requests, resulting in service unavailability for legitimate users (Eclipse Security).

• Network: High volume of HTTP requests with Expect: 100-continue headers from one or more source IPs; connections that establish and send partial or zero-byte request bodies; unusually high number of slow or stalled HTTP connections.
• Logs: Jetty access logs showing repeated requests with Expect: 100-continue that do not complete normally; increased frequency of connection timeouts or read errors in server logs.
• Process/System: Steadily increasing JVM heap or off-heap memory usage on the Jetty process without corresponding increase in legitimate traffic; garbage collection logs showing inability to reclaim buffer pool memory; eventual OutOfMemoryError or service crash in Jetty logs.

Upgrade Eclipse Jetty to version 10.0.23 or 11.0.23, which contain the fix for this buffer leak (Eclipse Security). As interim mitigations, implement rate limiting and connection limits on HTTP requests — particularly those using Expect: 100-continue headers — at the load balancer or reverse proxy layer. Configure aggressive network timeout settings to close stalled or slow connections before they can accumulate leaked buffers. Additionally, consider enforcing request body size limits to reduce the window for exploitation.

The vulnerability was noted in a CISA vulnerability bulletin shortly after disclosure, indicating it reached the attention of U.S. government cybersecurity monitoring (CISA Bulletin). Tenable published a Nessus detection plugin (ID 327160) for the vulnerability (Tenable). No significant researcher commentary or social media discussion has been observed beyond standard vulnerability aggregator coverage.