CVE-2019-17638: In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jet...

Security readout for executives and security teams

Affected Eclipse Jetty versions can accidentally send one user's response data to another user when oversized response headers trigger an error path. The exposed data could include session IDs or authentication credentials. This is primarily a confidentiality issue, with business urgency highest for multi-user web services running the affected Jetty range. Exposure is likely where applications, platforms, or packaged products embed Eclipse Jetty 9.4.27.v20200227 through 9.4.29.v20200521. Public references include downstream package and project discussions, so validate both direct Jetty deployments and transitive dependencies. Patch or mitigate confirmed affected Jetty services promptly, especially customer-facing or shared applications. This is not evidenced as actively exploited in the supplied sources, but the potential leakage of credentials and session data makes delayed remediation risky. Mitigation focus: Upgrade Eclipse Jetty outside the affected 9.4.27 to 9.4.29 range.; If upgrade is blocked, check current vendor guidance for supported mitigation.; Set responseHeaderSize significantly larger than requestHeaderSize where vendor guidance allows..

Prepared

Jun 3, 2026, 10:59 UTC (UTC+00:00)

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.