CVE-2011-4461: Jetty 8.1.0.RC2 and earlier computes hash values for form parameters without restricting the ability to tri...

Security readout for executives and security teams

This is an old Jetty denial-of-service issue. A remote requester could send many specially crafted form parameters that make Jetty spend excessive CPU calculating hash values. The expected business impact is service slowdown or outage, not data theft or code execution, based on the supplied sources. Exposure is most likely in internet-facing or internal web applications running Jetty 8.1.0.RC2 or earlier, especially endpoints accepting form submissions. Downstream vendor advisories exist, so bundled Jetty in appliances or packaged software should also be checked. Treat this as a service-availability risk. Prioritize externally reachable Jetty systems and business-critical applications, but it is lower urgency than confirmed exploited code-execution flaws because the bundle does not show active exploitation or data compromise. Mitigation focus: Inventory applications and products using Jetty 8.1.0.RC2 or earlier.; Apply fixed Jetty or distribution packages from the relevant vendor advisory.; Review downstream vendor advisories for bundled Jetty exposure..

Prepared

Jun 27, 2026, 17:28 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.