Vulnerabilities

 5 via 7 paths

Dependencies

 78

Source

 GitHub

Find, fix and prevent vulnerabilities in your code.

Test and protect my applications
Issue type
  • 5
  • 2
Severity
  • 1
  • 2
  • 4
Status
  • 7
  • 0
  • 0

critical severity

HTTP Request Smuggling

  • Vulnerable module: org.eclipse.jetty:jetty-http
  • Introduced through: org.eclipse.jetty:jetty-servlet@9.4.58.v20250814

Detailed paths

  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.eclipse.jetty:jetty-servlet@9.4.58.v20250814 › org.eclipse.jetty:jetty-security@9.4.58.v20250814 › org.eclipse.jetty:jetty-server@9.4.58.v20250814 › org.eclipse.jetty:jetty-http@9.4.58.v20250814

Overview

org.eclipse.jetty:jetty-http is an is a http module for jetty server.

Affected versions of this package are vulnerable to HTTP Request Smuggling in the HTTP/1.1 parser (HttpParser.java). An attacker can inject additional HTTP requests with chunked transfer encoding with improperly terminated quoted strings.

Remediation

Upgrade org.eclipse.jetty:jetty-http to version 12.0.33, 12.1.7 or higher.

References

HTTP Request Smuggling vulnerability report

high severity

Uncontrolled Recursion

  • Vulnerable module: commons-lang:commons-lang
  • Introduced through: org.constretto:constretto-core@2.2.3 and org.constretto:constretto-spring@2.2.3

Detailed paths

  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-core@2.2.3 › org.constretto:constretto-api@2.2.3 › commons-lang:commons-lang@2.6
  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-spring@2.2.3 › org.constretto:constretto-api@2.2.3 › commons-lang:commons-lang@2.6
  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-spring@2.2.3 › org.constretto:constretto-core@2.2.3 › org.constretto:constretto-api@2.2.3 › commons-lang:commons-lang@2.6

Overview

Affected versions of this package are vulnerable to Uncontrolled Recursion via the ClassUtils.getClass function. An attacker can cause the application to terminate unexpectedly by providing excessively long input values.

Remediation

There is no fixed version for commons-lang:commons-lang.

References

Uncontrolled Recursion vulnerability report

high severity
new

Incorrect Implementation of Authentication Algorithm

  • Vulnerable module: org.eclipse.jetty:jetty-security
  • Introduced through: org.eclipse.jetty:jetty-servlet@9.4.58.v20250814

Detailed paths

  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.eclipse.jetty:jetty-servlet@9.4.58.v20250814 › org.eclipse.jetty:jetty-security@9.4.58.v20250814

Overview

Affected versions of this package are vulnerable to Incorrect Implementation of Authentication Algorithm due to lossy ISO-8859-1 encoding in the digest hash computation. An attacker can log in as a user with a non-Latin-1 password by supplying a collision password that replaces each non-ASCII character with ?, producing the same digest response hash. The vulnerable code feeds the username/password material into getBytes(StandardCharsets.ISO_8859_1) when computing the digest values, so characters above U+00FF are silently substituted before hashing. That lets an attacker authenticate successfully with a different password while the victim’s Digest-authenticated account accepts the forged response.

Remediation

Upgrade org.eclipse.jetty:jetty-security to version 9.4.63, 10.0.31, 11.0.31, 12.0.36, 12.1.10 or higher.

References

Incorrect Implementation of Authentication Algorithm vulnerability report

medium severity
new

Improper Validation of Consistency within Input

  • Vulnerable module: org.eclipse.jetty:jetty-server
  • Introduced through: org.eclipse.jetty:jetty-servlet@9.4.58.v20250814

Detailed paths

  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.eclipse.jetty:jetty-servlet@9.4.58.v20250814 › org.eclipse.jetty:jetty-security@9.4.58.v20250814 › org.eclipse.jetty:jetty-server@9.4.58.v20250814

Overview

org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.

Affected versions of this package are vulnerable to Improper Validation of Consistency within Input through ComplianceUtils.verify(HttpURI, HttpFields, HttpCompliance, ComplianceViolation.Listener) in jetty-core/jetty-http/src/main/java/org/eclipse/jetty/http/ComplianceUtils.java. An attacker can bypass host consistency checks by sending a request whose :authority pseudo-header and Host header name different hosts, causing Jetty to accept the request and expose conflicting host identities to different code paths. This lets attacker-controlled host information survive inside the request, so logic that relies on Request.getServerName() or the URI authority can see one host while code reading the raw Host header sees another. In deployments that use host-based routing, ACLs, redirects, or tenant isolation, this can lead to incorrect request handling, host-based access control bypass, and attacker-influenced URL generation or logging.

Notes

  • HTTP/1.1 already had its own authority/Host consistency path in HttpConnection/HttpChannelState; the gap was in the HTTP/2 and HTTP/3 server entry flow where the shared compliance check was invoked before that comparison happened.
  • The mismatch check only rejects when both values are present and differ after normalizing case and default ports, so requests with only one of :authority or Host present are not part of this issue.

Remediation

Upgrade org.eclipse.jetty:jetty-server to version 9.4.61, 10.0.29, 11.0.29, 12.0.35, 12.1.9 or higher.

References

Improper Validation of Consistency within Input vulnerability report

medium severity

Interpretation Conflict

  • Vulnerable module: org.eclipse.jetty:jetty-server
  • Introduced through: org.eclipse.jetty:jetty-servlet@9.4.58.v20250814

Detailed paths

  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.eclipse.jetty:jetty-servlet@9.4.58.v20250814 › org.eclipse.jetty:jetty-security@9.4.58.v20250814 › org.eclipse.jetty:jetty-server@9.4.58.v20250814

Overview

org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.

Affected versions of this package are vulnerable to Interpretation Conflict due to inconsistent handling of invalid or unusual URIs in the parse() function on HttpURI.java‎. An attacker can bypass security controls or access restricted resources by crafting specially formatted URIs that are interpreted differently by various system components.

Remediation

Upgrade org.eclipse.jetty:jetty-server to version 12.0.31, 12.1.5 or higher.

References

Interpretation Conflict vulnerability report

medium severity

EPL-1.0 license

  • Module: junit:junit
  • Introduced through: junit:junit@4.13.2, org.constretto:constretto-core@2.2.3 and others

Detailed paths

  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-core@2.2.3 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-spring@2.2.3 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-core@2.2.3 › org.constretto:constretto-api@2.2.3 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-spring@2.2.3 › org.constretto:constretto-api@2.2.3 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-spring@2.2.3 › org.constretto:constretto-core@2.2.3 › junit:junit@4.13.2
  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-spring@2.2.3 › org.constretto:constretto-core@2.2.3 › org.constretto:constretto-api@2.2.3 › junit:junit@4.13.2

EPL-1.0 license

EPL-1.0 license vulnerability report

medium severity

EPL-1.0 license

  • Module: org.aspectj:aspectjweaver
  • Introduced through: org.constretto:constretto-spring@2.2.3

Detailed paths

  • Introduced through: Cantara/Whydah-SPAProxyService@Cantara/Whydah-SPAProxyService › org.constretto:constretto-spring@2.2.3 › org.aspectj:aspectjweaver@1.7.4

EPL-1.0 license

EPL-1.0 license vulnerability report