CVE-2017-9735: Jetty through 9.4.x is prone to a timing channel in util/security/Password.java, which makes it easier for...

Security readout for executives and security teams

This CVE is a password-checking timing leak in Jetty. An attacker who can repeatedly reach affected authentication code may learn from small response-time differences when wrong passwords are rejected, making unauthorized access easier. The bundle does not provide CVSS, confirmed exploitation, or a named fixed version. Exposure is most likely in applications, appliances, or bundled platforms that use Jetty through 9.4.x for password validation, including transitive dependencies identified by dependency scanners. Internet-facing login paths increase relevance. Treat as a dependency hygiene and authentication hardening issue. Prioritize externally reachable systems and products with embedded Jetty, but do not escalate as an emergency without additional evidence of exploitation or business-critical exposure. Mitigation focus: Inventory direct and transitive Jetty dependencies across applications and vendor products.; Check Eclipse Jetty and distribution advisories for the supported fixed package or version.; Upgrade affected Jetty packages through normal vendor or package-manager channels..

Prepared

Jun 13, 2026, 04:43 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.