1
- jetty-11.0.17-SNAPSHOT
1
+ jetty-11.0.17 - 09 October 2023
2
+ + 9777 CrossOriginFilter does not return Vary header on no-cors mode
3
+ + 9928 Backport `Request.getBeginNanoTime()`
4
+ + 10271 jetty.sh does not stop jetty anymore
5
+ + 10473 Startup Script reports `ok` too fast, and doesn't wait for actual
6
+ start of Jetty
7
+ + 10547 Cannot customize Executor on WebSocketClient
8
+ + 10679 Review HTTP/2 rate control
2
9
3
10
jetty-11.0.16 - 25 August 2023
4
11
+ 6140 Report total number of keys in SelectorManager
@@ -58,7 +65,8 @@ jetty-11.0.15 - 11 April 2023
58
65
+ 9309 `jetty.sh` cannot handle complex Jetty properties from `start.d/*.ini`
59
66
+ 9400 Jetty logs warning with stacktrace when annotation parser encounters
60
67
module-info.class file inside elasticsearch-x-content jar
61
- + 9464 Add optional configuration to log user out after OpenID idToken expires (CVE-2023-41900)
68
+ + 9464 Add optional configuration to log user out after OpenID idToken expires
69
+ (CVE-2023-41900)
62
70
+ 9468 Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
63
71
+ 9497 Maven plugin effective web xml: add support for jar projects
64
72
+ 9501 jetty client with proxy - ssl traffic between both proxy and servers
@@ -222,7 +230,8 @@ jetty-10.0.15 - 11 April 2023
222
230
+ 9309 `jetty.sh` cannot handle complex Jetty properties from `start.d/*.ini`
223
231
+ 9400 Jetty logs warning with stacktrace when annotation parser encounters
224
232
module-info.class file inside elasticsearch-x-content jar
225
- + 9464 Add optional configuration to log user out after OpenID idToken expires (CVE-2023-41900)
233
+ + 9464 Add optional configuration to log user out after OpenID idToken expires
234
+ (CVE-2023-41900)
226
235
+ 9468 Jetty 11.0.14 is less tolerant of non-compliant cookies than 11.0.13
227
236
+ 9497 Maven plugin effective web xml: add support for jar projects
228
237
+ 9501 jetty client with proxy - ssl traffic between both proxy and servers
@@ -508,7 +517,6 @@ jetty-10.0.10 - 16 June 2022
508
517
properties
509
518
+ 8161 Improve SSLConnection buffers handling (CVE-2022-2191)
510
519
511
-
512
520
jetty-9.4.47.v20220610 - 10 June 2022
513
521
+ 4717 High CPU spikes with jetty winstone threads
514
522
+ 7748 Allow overriding of url-pattern mapping in ServletContextHandler to
@@ -953,7 +961,8 @@ jetty-10.0.3 - 20 May 2021
953
961
+ 6254 Total timeout not enforced for queued requests
954
962
+ 6263 Review URI encoding in ConcatServlet & WelcomeFilter (CVE-2021-28169)
955
963
+ 6272 Reduce allocation in HttpClient when notifying content listeners
956
- + 6277 Better handle exceptions thrown from session destroy listener (CVE-2021-34428)
964
+ + 6277 Better handle exceptions thrown from session destroy listener
965
+ (CVE-2021-34428)
957
966
+ 6280 Copy ServletHolder class/instance properly during startWebapp
958
967
+ 6287 Class loading broken for WebSocketClient used inside webapp
959
968
@@ -1207,7 +1216,7 @@ jetty-11.0.0.beta1 - 10 July 2020
1207
1216
SETTINGS Frame.
1208
1217
+ 4903 Give better errors for non public Websocket Endpoints
1209
1218
+ 4904 WebsocketClient creates more connections than needed
1210
- + 4907
1219
+ + 4907
1211
1220
org.eclipse.jetty.websocket.tests.SuspendResumeTest#testSuspendAfterClose
1212
1221
+ 4920 Restore ability to delete sessions on stop
1213
1222
+ 4921 Quickstart run improperly runs dynamically added context initializers
@@ -1257,7 +1266,8 @@ jetty-10.0.2 - 26 March 2021
1257
1266
+ 6037 Review logging modules for j.u.l
1258
1267
+ 6050 Websocket: NotUtf8Exception after upgrade 9.4.35 -> 9.4.36 or newer
1259
1268
+ 6063 Allow override of hazelcast version when using module
1260
- + 6072 jetty server high CPU when client send data length > 17408 (CVE-2021-28165)
1269
+ + 6072 jetty server high CPU when client send data length > 17408
1270
+ (CVE-2021-28165)
1261
1271
+ 6076 Embedded Jetty throws null pointer exception
1262
1272
+ 6082 SslConnection compacting
1263
1273
+ 6085 Jetty keeps Sessions in use after "Duplicate valid session cookies"
@@ -1333,7 +1343,8 @@ jetty-10.0.0 - 02 December 2020
1333
1343
+ 5555 NPE for servlet with no mapping
1334
1344
+ 5562 ArrayTernaryTrie consumes too much memory
1335
1345
+ 5575 Add SEARCH as a known HttpMethod
1336
- + 5605 java.io.IOException: unconsumed input during http request parsing (CVE-2020-27218)
1346
+ + 5605 java.io.IOException: unconsumed input during http request parsing
1347
+ (CVE-2020-27218)
1337
1348
+ 5633 Allow to configure HttpClient request authority
1338
1349
+ 5679 Distro argument --list-all-modules does not work
1339
1350
+ 5680 No way to see which modules are enabled for the distro
@@ -1620,7 +1631,8 @@ jetty-9.4.41.v20210516 - 16 May 2021
1620
1631
`AsyncContext.dispatch`
1621
1632
+ 6254 Total timeout not enforced for queued requests
1622
1633
+ 6263 Review URI encoding in ConcatServlet & WelcomeFilter (CVE-2021-28169)
1623
- + 6277 Better handle exceptions thrown from session destroy listener (CVE-2021-34428)
1634
+ + 6277 Better handle exceptions thrown from session destroy listener
1635
+ (CVE-2021-34428)
1624
1636
+ 6280 Copy ServletHolder class/instance properly during startWebapp
1625
1637
1626
1638
jetty-9.4.40.v20210413 - 13 April 2021
@@ -1636,7 +1648,8 @@ jetty-9.4.39.v20210325 - 25 March 2021
1636
1648
+ 6052 Cleanup TypeUtil and ModuleLocation to allow jetty-client/hybrid to
1637
1649
work on Android
1638
1650
+ 6063 Allow override of hazelcast version when using module
1639
- + 6072 jetty server high CPU when client send data length > 17408 (CVE-2021-28165)
1651
+ + 6072 jetty server high CPU when client send data length > 17408
1652
+ (CVE-2021-28165)
1640
1653
+ 6085 Jetty keeps Sessions in use after "Duplicate valid session cookies"
1641
1654
Message
1642
1655
+ 6101 Normalize ambiguous URIs (CVE-2021-28164)
@@ -1692,7 +1705,8 @@ jetty-9.4.35.v20201120 - 20 November 2020
1692
1705
+ 5539 StatisticsServlet output is not valid
1693
1706
+ 5562 ArrayTernaryTrie consumes too much memory
1694
1707
+ 5575 Add SEARCH as a known HttpMethod
1695
- + 5605 java.io.IOException: unconsumed input during http request parsing (CVE-2020-27218)
1708
+ + 5605 java.io.IOException: unconsumed input during http request parsing
1709
+ (CVE-2020-27218)
1696
1710
+ 5633 Allow to configure HttpClient request authority
1697
1711
1698
1712
jetty-9.4.34.v20201102 - 02 November 2020
@@ -2186,8 +2200,10 @@ jetty-9.4.18.v20190429 - 29 April 2019
2186
2200
jetty-9.4.17.v20190418 - 18 April 2019
2187
2201
+ 2140 Infinispan and hazelcast changes to scavenge zombie expired sessions
2188
2202
+ 3464 Split SslContextFactory into Client and Server
2189
- + 3549 Directory Listing on Windows reveals Resource Base path (CVE-2019-10246)
2190
- + 3555 DefaultHandler Reveals Base Resource Path of each Context (CVE-2019-10247)
2203
+ + 3549 Directory Listing on Windows reveals Resource Base path
2204
+ (CVE-2019-10246)
2205
+ + 3555 DefaultHandler Reveals Base Resource Path of each Context
2206
+ (CVE-2019-10247)
2191
2207
2192
2208
jetty-9.4.16.v20190411 - 11 April 2019
2193
2209
+ 1861 Limit total bytes pooled by ByteBufferPools
@@ -2268,8 +2284,10 @@ jetty-9.3.28.v20191105 - 05 November 2019
2268
2284
+ 4217 SslConnection.DecryptedEnpoint.flush eternal busy loop
2269
2285
2270
2286
jetty-9.3.27.v20190418 - 18 April 2019
2271
- + 3549 Directory Listing on Windows reveals Resource Base path (CVE-2019-10246)
2272
- + 3555 DefaultHandler Reveals Base Resource Path of each Context (CVE-2019-10247)
2287
+ + 3549 Directory Listing on Windows reveals Resource Base path
2288
+ (CVE-2019-10246)
2289
+ + 3555 DefaultHandler Reveals Base Resource Path of each Context
2290
+ (CVE-2019-10247)
2273
2291
2274
2292
jetty-9.3.26.v20190403 - 03 April 2019
2275
2293
+ 2954 Improve cause reporting for HttpClient failures
@@ -2283,11 +2301,14 @@ jetty-9.2.29.v20191105 - 05 November 2019
2283
2301
+ 4217 SslConnection.DecryptedEnpoint.flush eternal busy loop
2284
2302
2285
2303
jetty-9.2.28.v20190418 - 18 April 2019
2286
- + 3549 Directory Listing on Windows reveals Resource Base path (CVE-2019-10246)
2287
- + 3555 DefaultHandler Reveals Base Resource Path of each Context (CVE-2019-10247)
2304
+ + 3549 Directory Listing on Windows reveals Resource Base path
2305
+ (CVE-2019-10246)
2306
+ + 3555 DefaultHandler Reveals Base Resource Path of each Context
2307
+ (CVE-2019-10247)
2288
2308
2289
2309
jetty-9.2.27.v20190403 - 03 April 2019
2290
- + 3319 Refactored Directory Listing to modernize and avoid XSS (CVE-2019-10241)
2310
+ + 3319 Refactored Directory Listing to modernize and avoid XSS
2311
+ (CVE-2019-10241)
2291
2312
2292
2313
jetty-9.4.14.v20181114 - 14 November 2018
2293
2314
+ 3097 Duplicated programmatic Servlet Listeners causing duplicate calls
0 commit comments