Skip to content

Upgrading org.eclipse.jetty:jetty-servlet 10 to 11

Breaking10.0.26 → 11.0.26Breaking14Security22Platform1Deprecated8New46Changed272Fixed239Other83

Full comparisonBack to org.eclipse.jetty:jetty-servlet
BreakingUpgrade verdict

14 breaking changes and a platform requirement change and 22 security fixes.

In plain terms
  • Code that changed HTTP response headers inside the onResponseBegin listener callback no longer works.
  • Removes the unmaintained jminix module since hawtio provides the same features.
  • Drops modules that are no longer supported.
  • The old distribution package is gone; set up a jetty-home plus your own base directory instead.
Must act Top 5 of 45 that need code or config changes

What you must change

Breaking14
Modifying HTTP headers in HttpChannel.Listener#onResponseBegin is no longer possible with Jetty 10.
HttpChannel.Listener#onResponseBegin
11.0.26GitHub ReleaseSummarizedView source
Removes the unmaintained jminix module since hawtio provides the same features.
jminix
11.0.9GitHub ReleaseSummarizedView source
Removes unsupported modules.
11.0.9GitHub ReleaseSummarizedView source
jetty-distribution is removed; use jetty-home with a proper ${jetty.base}.
jetty-distributionjetty-home${jetty.base}
11.0.0GitHub ReleaseSummarizedView source
Removes the jetty-all uber artifact.
jetty-all
11.0.0GitHub ReleaseSummarizedView source
Removes jetty-all.
jetty-all
11.0.0.beta2GitHub ReleaseSummarizedView source
Removes jetty-distribution in favor of jetty-home.
jetty-distributionjetty-home
11.0.0.beta2GitHub ReleaseSummarizedView source
Removes unused methods on SessionHandler.
SessionHandler
11.0.0.beta2GitHub ReleaseSummarizedView source
Disallows webapps overriding jakarta.* container classes per Servlet 5.0 Section 15.2.1.
11.0.3GitHub ReleaseSummarizedView source
Jetty 11.x uses the jakarta.servlet namespace; use Jetty 10.x for javax.servlet.
jakarta.servletjavax.servlet
11.0.0GitHub ReleaseSummarizedView source
Classic Jetty logging facade is replaced with slf4j-api usage.
slf4j-api
11.0.0GitHub ReleaseSummarizedView source
Managing Configuration within a WebAppContext has a new API that is self ordering.
ConfigurationWebAppContext
11.0.0GitHub ReleaseSummarizedView source
Complete WebSocket refactoring requires code updates for Jetty API or embedded Jetty users.
11.0.0GitHub ReleaseSummarizedView source
Uses the jakarta.* namespace for new Jakarta EE 9 "Big Bang" artifacts.
11.0.0GitHub ReleaseSummarizedView source
Security22
HTTP2Session cleanups that address CVE-2025-5115.
HTTP2Session
11.0.26GitHub ReleaseSummarizedView source
Fixes CVE-2024-22201, where HTTP/2 connections are not closed after idle timeout when TCP is congested.
11.0.20GitHub ReleaseSummarizedView source
Addresses CVE-2023-44487, the HTTP/2 rapid reset denial-of-service vulnerability.
11.0.17GitHub ReleaseSummarizedView source
Addresses GHSA-58qw-p7qm-5rvh, providing a workaround for direct users of XmlParser.
XmlParser
11.0.16GitHub ReleaseSummarizedView source
Addresses CVE-2023-40167.
11.0.16GitHub ReleaseSummarizedView source
Addresses CVE-2023-36478.
11.0.16GitHub ReleaseSummarizedView source
Addresses CVE-2023-36479.
11.0.16GitHub ReleaseSummarizedView source
Rejects "+" prefixed values in Content-Length (CVE-2023-40167).
Content-Length
11.0.16GitHub ReleaseSummarizedView source
Addresses CVE-2023-41900.
11.0.15GitHub ReleaseSummarizedView source
Cleans up Multipart handling for CVE-2023-26048.
11.0.14GitHub ReleaseSummarizedView source
Cleans up Cookie Cutter handling for CVE-2023-26049.
11.0.14GitHub ReleaseSummarizedView source
Fixes CVE-2022-2047: invalid URI parsing may produce an invalid HttpURI.authority.
HttpURI.authority
11.0.10GitHub ReleaseSummarizedView source
Fixes CVE-2022-2048: invalid HTTP/2 requests can lead to denial of service.
11.0.10GitHub ReleaseSummarizedView source
Fixes CVE-2022-2191: SslConnection does not release pooled ByteBuffers in case of errors.
SslConnectionByteBuffers
11.0.10GitHub ReleaseSummarizedView source
Resolves CVE-2021-34429.
11.0.6GitHub ReleaseSummarizedView source
Resolves CVE-2021-28169 and CVE-2021-34428.
11.0.3GitHub ReleaseSummarizedView source
Fixes CVE-2021-28165, where the Jetty server uses high CPU when a client sends data with length greater than 17408.
11.0.2GitHub ReleaseSummarizedView source
Fixes CVE-2021-28164 by normalizing ambiguous URIs.
11.0.2GitHub ReleaseSummarizedView source
Fixes CVE-2021-28163 by excluding the webapps directory from the deployment scan.
11.0.2GitHub ReleaseSummarizedView source
Addresses and resolves CVE-2020-27223.
11.0.1GitHub ReleaseSummarizedView source
Fixes an open redirect when sending a custom Host header to a URL with no trailing forward-slash.
11.0.0.beta2GitHub ReleaseSummarizedView source
Fixes CWE-331 in the DigestAuthentication class.
DigestAuthentication
11.0.0.beta2GitHub ReleaseSummarizedView source
Platform1
Jetty 11.x requires a minimum of Java 11.
11.0.0GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated8
Better documents the deprecation of ContextHandler.setCompactPath(boolean).
ContextHandler.setCompactPath(boolean)
11.0.25GitHub ReleaseSummarizedView source
Deprecates PushCacheFilter.
PushCacheFilter
11.0.18GitHub ReleaseSummarizedView source
Deprecates the CGI Servlet (CVE-2023-36479).
CGI Servlet
11.0.16GitHub ReleaseSummarizedView source
Deprecates PushSessionCacheFilter.
PushSessionCacheFilter
11.0.16GitHub ReleaseSummarizedView source
Deprecates log4j 1.x support.
log4j
11.0.8GitHub ReleaseSummarizedView source
Deprecates UnixSocket JNR support.
UnixSocket
11.0.8GitHub ReleaseSummarizedView source
Deprecates support for UTF16 encoding in URIs.
11.0.6GitHub ReleaseSummarizedView source
Adds a DeprecationWarning Decorator.
11.0.3GitHub ReleaseSummarizedView source

API changes

Generated by DepDelta from published JVM bytecode. Not mixed with prose notes.

  • removed: static field Source.Origin.JAVAX_API: Source.Origin
  • added: static field Source.Origin.JAKARTA_API: Source.Origin