CVE-2015-2080: Eclipse Jetty HTTP header parsing leaks process memory

Automated analysis

Generated by VULONE's analysis model from the NVD record, CISA KEV and EPSS data on 18 September 2026. Confidence: high.

high priorityUnauthenticated remote memory disclosure with public exploit code and very high EPSS, but no KEV listing and only confidentiality impact.

What it is

Eclipse Jetty before 9.2.9.v20150224 mishandles illegal characters in an HTTP header, causing the exception handling code to return data from process memory in the error response. This is the JetLeak flaw, and it matters because unauthenticated remote attackers can read residual shared buffer contents that may include credentials, session data or other sensitive material.

Impact

An attacker gains disclosure of process memory contents returned in HTTP responses, potentially exposing credentials, tokens or other sensitive data from other requests. There is no integrity or availability impact; the loss is confidentiality only.

Attack surface

Reachable over the network by sending a crafted HTTP request with illegal characters in a header to a vulnerable Jetty listener. No authentication and no user interaction are required per the CVSS vector AV:N/AC:L/PR:N/UI:N.

Exploitation

Public exploit references exist (Packet Storm, Full Disclosure, GDS Security and the vendor advisory are tagged Exploit), and EPSS is very high at 0.75441 (99.5th percentile), though CVE-2015-2080 is not listed in CISA KEV. No ransomware group use is documented.

What to do

• Upgrade Eclipse Jetty to 9.2.9.v20150224 or later; this is the only complete fix.
• Update or replace Fedora packages carrying the affected Jetty build, and check NetApp product advisories for bundled Jetty.
• If immediate upgrade is impossible, restrict network access to Jetty listeners and terminate HTTP at a proxy that rejects malformed headers.
• Audit logs and responses for leaked buffer content and rotate any credentials or tokens that may have been exposed.

Detection

• Inspect HTTP responses for unexpected binary or non-ASCII data appended to error pages or headers.
• Alert on requests containing illegal or control characters in HTTP header names or values reaching Jetty.
• Monitor for repeated malformed-header requests from a single source, which is consistent with memory-scraping attempts.
• Review Jetty error logs for parser exceptions tied to header parsing on internet-facing instances.

This assessment is produced automatically and is not human-reviewed. Verify against the vendor advisory before acting on it.