Skip to content

Upgrading org.eclipse.jetty:jetty-server 10 to 11

Breaking10.0.26 → 11.0.26Breaking13Security25Platform1Deprecated7New47Changed252Fixed239Other102

Full comparisonBack to org.eclipse.jetty:jetty-server
BreakingUpgrade verdict

13 breaking changes and a platform requirement change and 25 security fixes.

In plain terms
  • Code that changed HTTP response headers inside the onResponseBegin listener callback no longer works.
  • Removes the unmaintained jminix module since hawtio provides the same features.
  • Drops modules that are no longer supported.
  • The old distribution package is gone; set up Jetty using jetty-home and a separate base directory.
Must act Top 5 of 46 that need code or config changes

Adds org.eclipse.jetty.toolchain:jetty-jakarta-servlet-api 5.0.2.

Drops org.eclipse.jetty.toolchain:jetty-servlet-api.

What you must change

Breaking13
Modifying HTTP headers in HttpChannel.Listener#onResponseBegin is no longer possible with Jetty 10.
HttpChannel.Listener#onResponseBegin
11.0.26GitHub ReleaseSummarizedView source
Removes the unmaintained jminix module since hawtio provides the same features.
jminix
11.0.9GitHub ReleaseSummarizedView source
Removes unsupported modules.
11.0.9GitHub ReleaseSummarizedView source
jetty-distribution is removed; use jetty-home with a proper ${jetty.base} instead.
jetty-distributionjetty-home${jetty.base}
11.0.0GitHub ReleaseSummarizedView source
Removes the jetty-all uber artifact.
jetty-all
11.0.0GitHub ReleaseSummarizedView source
Removes the jetty-all artifact.
jetty-all
11.0.0.beta2GitHub ReleaseSummarizedView source
Removes jetty-distribution in favor of jetty-home.
jetty-distributionjetty-home
11.0.0.beta2GitHub ReleaseSummarizedView source
Removes unused methods on SessionHandler.
SessionHandler
11.0.0.beta2GitHub ReleaseSummarizedView source
Jetty 11.x is the first major version to use the jakarta.servlet namespace; use Jetty 10.x for javax.servlet.
jakarta.servletjavax.servlet
11.0.0GitHub ReleaseSummarizedView source
Classic Jetty logging facade is replaced with slf4j-api usage.
slf4j-api
11.0.0GitHub ReleaseSummarizedView source
Managing Configuration within a WebAppContext has a new API that is self ordering.
ConfigurationWebAppContext
11.0.0GitHub ReleaseSummarizedView source
Complete WebSocket refactoring requires code updates for Jetty API and embedded-jetty users.
11.0.0GitHub ReleaseSummarizedView source
Uses the jakarta.* namespace for new Jakarta EE 9 Big Bang artifacts.
jakarta.*
11.0.0GitHub ReleaseSummarizedView source
Security25
HTTP2Session cleanups that address CVE-2025-5115.
HTTP2Session
11.0.26GitHub ReleaseSummarizedView source
Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
Moderate · CVSS 5.9
11.0.24GitHub AdvisoryOriginalView source
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
High · CVSS 7.5
11.0.23GitHub AdvisoryOriginalView source
Fixes CVE-2024-22201: HTTP/2 connection not closed after idle timeout when TCP is congested.
11.0.20GitHub ReleaseSummarizedView source
Addresses CVE-2023-44487, the HTTP/2 rapid reset denial of service vulnerability.
11.0.17GitHub ReleaseSummarizedView source
Addresses GHSA-58qw-p7qm-5rvh, providing a workaround for direct users of XmlParser.
XmlParser
11.0.16GitHub ReleaseSummarizedView source
Addresses CVE-2023-40167.
11.0.16GitHub ReleaseSummarizedView source
Addresses CVE-2023-36478.
11.0.16GitHub ReleaseSummarizedView source
Addresses CVE-2023-36479.
11.0.16GitHub ReleaseSummarizedView source
Rejects "+" prefixed values in Content-Length (CVE-2023-40167).
Content-Length
11.0.16GitHub ReleaseSummarizedView source
Addresses CVE-2023-41900.
11.0.15GitHub ReleaseSummarizedView source
Cleans up Multipart handling for CVE-2023-26048.
Moderate · CVSS 5.3
11.0.14GitHub ReleaseSummarizedView source
Cleans up Cookie Cutter handling for CVE-2023-26049.
Low · CVSS 2.4
11.0.14GitHub ReleaseSummarizedView source
Fixes CVE-2022-2047: invalid URI parsing may produce an invalid HttpURI.authority.
HttpURI.authority
11.0.10GitHub ReleaseSummarizedView source
Fixes CVE-2022-2048: invalid HTTP/2 requests can lead to denial of service.
11.0.10GitHub ReleaseSummarizedView source
Fixes CVE-2022-2191: SslConnection does not release pooled ByteBuffers on errors.
SslConnectionHigh · CVSS 7.5
11.0.10GitHub ReleaseSummarizedView source
Improves SSLConnection buffer handling, resolving CVE-2022-2191.
SSLConnectionHigh · CVSS 7.5
11.0.10GitHub ReleaseSummarizedView source
Resolves CVE-2021-34429.
11.0.6GitHub ReleaseSummarizedView source
Resolves CVE-2021-28169 and CVE-2021-34428.
Low · CVSS 3.5
11.0.3GitHub ReleaseSummarizedView source
Fixes CVE-2021-28165: jetty server high CPU when client sends data length > 17408.
High · CVSS 7.5
11.0.2GitHub ReleaseSummarizedView source
Fixes CVE-2021-28164: normalizes ambiguous URIs.
11.0.2GitHub ReleaseSummarizedView source
Fixes CVE-2021-28163: excludes the webapps directory from deployment scan.
11.0.2GitHub ReleaseSummarizedView source
Addresses and resolves CVE-2020-27223.
Moderate · CVSS 5.3
11.0.1GitHub ReleaseSummarizedView source
Fixes an open redirect when sending a custom Host header to a URL with no trailing forward-slash.
11.0.0.beta2GitHub ReleaseSummarizedView source
Fixes CWE-331 in the DigestAuthentication class.
DigestAuthentication
11.0.0.beta2GitHub ReleaseSummarizedView source
Platform1
Jetty 11.x requires Java 11 as its minimum Java version.
11.0.0GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated7
Deprecates PushCacheFilter.
PushCacheFilter
11.0.18GitHub ReleaseSummarizedView source
Deprecates the CGI Servlet due to CVE-2023-36479.
CGI Servlet
11.0.16GitHub ReleaseSummarizedView source
Deprecates PushSessionCacheFilter.
PushSessionCacheFilter
11.0.16GitHub ReleaseSummarizedView source
Deprecates log4j 1.x support.
log4j
11.0.8GitHub ReleaseSummarizedView source
Deprecates UnixSocket JNR support.
UnixSocket
11.0.8GitHub ReleaseSummarizedView source
Deprecates support for UTF16 encoding in URIs.
11.0.6GitHub ReleaseSummarizedView source
Adds a DeprecationWarning Decorator.
11.0.3GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.

  • removed: static field SecureRequestCustomizer.JAVAX_SERVLET_REQUEST_CIPHER_SUITE: String
  • removed: static field SecureRequestCustomizer.JAVAX_SERVLET_REQUEST_KEY_SIZE: String
  • removed: static field SecureRequestCustomizer.JAVAX_SERVLET_REQUEST_SSL_SESSION_ID: String
  • removed: static field SecureRequestCustomizer.JAVAX_SERVLET_REQUEST_X_509_CERTIFICATE: String
  • added: static field SecureRequestCustomizer.JAKARTA_SERVLET_REQUEST_CIPHER_SUITE: String
  • added: static field SecureRequestCustomizer.JAKARTA_SERVLET_REQUEST_KEY_SIZE: String
  • added: static field SecureRequestCustomizer.JAKARTA_SERVLET_REQUEST_SSL_SESSION_ID: String
  • added: static field SecureRequestCustomizer.JAKARTA_SERVLET_REQUEST_X_509_CERTIFICATE: String