LowFix available
jetty9 — security advisory
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
- Products
- jetty9
- Affected versions
- Not specified
- Fixed versions
- 9.4.48-1
- CVEs
- CVE-2022-2047
- Confirmed fixed CVEs
- Not specified
- Updated in this feed
- 30 Oct 2026, 14:43 UTC · Revision 1
Source evidence
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.
osv:DEBIAN-CVE-2022-2047
jetty9
Fixed versions: 9.4.48-1
jetty9
Fixed versions: 9.4.48-1
jetty9
Fixed versions: 9.4.48-1
Complete source record
{
"id": "3136328f0d6fa1a0755717babe7c930d12fb7b0dc3db9eccbc9bf64c670fb9ab",
"url": "https://osv.dev/vulnerability/DEBIAN-CVE-2022-2047",
"method": "structured",
"payload": {
"kind": "advisory",
"title": "DEBIAN-CVE-2022-2047",
"summary": "In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.",
"evidence": "osv:DEBIAN-CVE-2022-2047",
"products": [
{
"name": {
"value": "jetty9",
"evidence": "/affected/0/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.4.48-1",
"evidence": "/affected/0/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "jetty9",
"evidence": "/affected/1/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.4.48-1",
"evidence": "/affected/1/ranges"
}
],
"affected_versions": []
},
{
"name": {
"value": "jetty9",
"evidence": "/affected/2/package/name"
},
"prerequisites": [],
"fixed_versions": [
{
"value": "9.4.48-1",
"evidence": "/affected/2/ranges"
}
],
"affected_versions": []
}
],
"severity": "low",
"structured": {
"id": "DEBIAN-CVE-2022-2047",
"aliases": [
"DEBIAN-CVE-2022-2047"
],
"metrics": [
{
"type": "CVSS_V3",
"score": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:N/I:L/A:N"
}
],
"affected": [
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.4.48-1"
}
]
}
],
"package": {
"name": "jetty9",
"purl": "pkg:deb/debian/jetty9?arch=source&distro=bookworm",
"ecosystem": "Debian:12"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-2047.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.4.48-1"
}
]
}
],
"package": {
"name": "jetty9",
"purl": "pkg:deb/debian/jetty9?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-2047.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "9.4.48-1"
}
]
}
],
"package": {
"name": "jetty9",
"purl": "pkg:deb/debian/jetty9?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2022-2047.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
],
"modified": "2026-10-15T08:01:39.886395036Z",
"provider": "osv",
"upstream": [
"CVE-2022-2047"
],
"references": [
"https://security-tracker.debian.org/tracker/CVE-2022-2047"
]
},
"related_cves": [
{
"value": "CVE-2022-2047",
"evidence": "/upstream"
}
],
"security_relevant": true,
"severity_evidence": "/severity/0/score"
},
"source_id": "core-osv",
"document_id": 323084,
"published_at": "2022-07-07T21:15:10.093+00:00"
}