CVE-2024-6762

What it actually does

Unauthenticated remote attackers can abuse the PushSessionCacheFilter in Jetty to allocate unbounded memory structures, leading to heap exhaustion and denial of service.

Why it matters to the business

Attackers can cause unplanned service outages and resource consumption on affected Jetty-based applications, disrupting availability for legitimate users until the server is restarted or resources are recovered.

How an attack unfolds

An unauthenticated attacker sends a series of specially crafted HTTP requests that trigger the PushSessionCacheFilter to create and retain session cache entries without proper bounds or authentication checks, gradually consuming all available server memory until the application becomes unresponsive.

How to fix it

Upgrade eclipse/jetty.project to a build that includes commit 9b415c6424a9e0614a349ae2d305800b33c5205a or later; alternatively apply vendor patches or configuration changes that disable or rate-limit the affected filter until the upgrade is complete.

How to confirm the fix worked

After patching, confirm the updated commit is present in the deployed Jetty binary or source tree, then attempt controlled requests that previously triggered cache growth to verify memory usage remains bounded.

Typical attack path

1. Discover publicly reachable Jetty servers running vulnerable versions
2. Identify endpoints protected by or invoking PushSessionCacheFilter
3. Send repeated unauthenticated requests crafted to inflate the session cache
4. Monitor memory usage until exhaustion forces the server into a degraded or crashed state

How to detect it

Review web server access logs and application performance metrics for sudden spikes in memory usage correlated with high volumes of requests to paths associated with PushSessionCacheFilter; look for patterns of repeated unauthenticated requests from single sources that precede resource exhaustion events.

What your security team should do

• Prioritize upgrade of all Jetty deployments to the fixed commit within standard change windows given low EPSS and absence from KEV
• Review and restrict exposure of any endpoints using PushSessionCacheFilter to trusted networks where possible
• Implement application-level rate limiting and memory monitoring as temporary compensating controls
• Add the fixed commit hash to vulnerability scanning and SBOM validation rules