Skip to content

Upgrading org.eclipse.jetty:jetty-webapp 10 to 11

Breaking10.0.26 → 11.0.25Breaking14Security28Platform1Deprecated9New42Changed289Fixed121Other177

Full comparisonBack to org.eclipse.jetty:jetty-webapp
BreakingUpgrade verdict

14 breaking changes and a platform requirement change and 28 security fixes.

In plain terms
  • ELContextCleaner no longer needed.
  • Modifying of HTTP headers in HttpChannel.Listener#onResponseBegin is no longer possible with Jetty.
  • The old distribution package is gone; set up a jetty.base directory and use jetty-home instead.
  • The single combined jetty-all jar no longer exists; depend on the individual modules instead.
Must act Top 5 of 52 that need code or config changes

What you must change

Breaking14
ELContextCleaner no longer needed.
11.0.13GitHub ReleaseOriginalView source
Modifying of HTTP headers in HttpChannel.Listener#onResponseBegin is no longer possible with Jetty.
11.0.10GitHub ReleaseOriginalView source
jetty-distribution is removed; use jetty-home with a proper ${jetty.base}.
jetty-distributionjetty-home${jetty.base}
11.0.0GitHub ReleaseSummarizedView source
The jetty-all uber artifact is removed.
jetty-all
11.0.0GitHub ReleaseSummarizedView source
Removes jetty-all.
jetty-all
11.0.0.beta2GitHub ReleaseSummarizedView source
Removes jetty-distribution in favor of jetty-home.
jetty-distributionjetty-home
11.0.0.beta2GitHub ReleaseSummarizedView source
Removes unused methods on SessionHandler.
SessionHandler
11.0.0.beta2GitHub ReleaseSummarizedView source
Incompatible with jacoco due to shutdown race condition.
11.0.9GitHub ReleaseOriginalView source
test-keystore.p12 is no longer packaged in jetty-home.
test-keystore.p12
11.0.8GitHub ReleaseOriginalView source
Jetty 11.x uses the jakarta.servlet namespace; use Jetty 10.x for javax.servlet.
jakarta.servletjavax.servlet
11.0.0GitHub ReleaseSummarizedView source
Classic Jetty logging facade is replaced with slf4j-api usage.
slf4j-api
11.0.0GitHub ReleaseSummarizedView source
Managing Configuration within a WebAppContext has a new API that is self ordering.
ConfigurationWebAppContext
11.0.0GitHub ReleaseSummarizedView source
Complete WebSocket refactoring requires code updates for Jetty API or embedded Jetty users.
11.0.0GitHub ReleaseSummarizedView source
Uses the jakarta.* namespace for new Jakarta EE 9 "Big Bang" artifacts.
11.0.0GitHub ReleaseSummarizedView source
Security28
CVE-2024-22201 - HTTP/2 connection not closed after idle timeout when TCP congested.
11.0.20GitHub ReleaseOriginalView source
CVE-2023-44487 - (in case isn't fixed, use top level link https://nvd.nist.gov/vuln/detail/CVE-2023-44487).
11.0.17GitHub ReleaseOriginalView source
GHSA-58qw-p7qm-5rvh - provides a workaround for direct users of XmlParser.
11.0.16GitHub ReleaseOriginalView source
CVE-2023-40167.
11.0.16GitHub ReleaseOriginalView source
CVE-2023-36478.
11.0.16GitHub ReleaseOriginalView source
CVE-2023-36479.
11.0.16GitHub ReleaseOriginalView source
Jetty accepts "+" prefixed value in Content-Length (CVE-2023-40167).
11.0.16GitHub ReleaseOriginalView source
Allow SAXParserFactory or SAXParser to be configured in Jetty's XmlParser class - Allows for GHSA-58qw-p7qm-5rvh workaround.
SAXParserFactorySAXParserXmlParser
11.0.16GitHub ReleaseOriginalView source
Deprecate CGI Servlet (CVE-2023-36479).
11.0.16GitHub ReleaseOriginalView source
CVE-2023-41900.
11.0.15GitHub ReleaseOriginalView source
Add optional configuration to log user out after OpenID idToken expires (CVE-2023-41900).
11.0.15GitHub ReleaseOriginalView source
Cleanup Multipart handling for CVE-2023-26048.
11.0.14GitHub ReleaseOriginalView source
Cleanup Cookie Cutter handling for CVE-2023-26049.
11.0.14GitHub ReleaseOriginalView source
(CVE-2022-2047) - https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q - Invalid URI parsing may produce invalid HttpURI.authority.
11.0.10GitHub ReleaseOriginalView source
(CVE-2022-2048) - https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j - Invalid HTTP/2 requests can lead to denial of service.
11.0.10GitHub ReleaseOriginalView source
(CVE-2022-2191) - https://github.com/eclipse/jetty.project/security/advisories/GHSA-8mpp-f3f7-xc28 - SslConnection does not release pooled ByteBuffers in case of errors.
11.0.10GitHub ReleaseOriginalView source
Improve SSLConnection buffers handling (Resolves CVE-2022-2191).
11.0.10GitHub ReleaseOriginalView source
Review HttpRequest URI construction (Resolves CVE-2022-2047).
11.0.10GitHub ReleaseOriginalView source
Review HTTP/2 error handling (Resolves CVE-2022-2048).
11.0.10GitHub ReleaseOriginalView source
Resolves CVE-2021-34429.
Moderate · CVSS 5.3
11.0.6GitHub ReleaseSummarizedView source
Resolves CVE-2021-28169 and CVE-2021-34428.
11.0.3GitHub ReleaseSummarizedView source
Fixes CVE-2021-28165, where the Jetty server uses high CPU when a client sends data length greater than 17408.
11.0.2GitHub ReleaseSummarizedView source
Fixes CVE-2021-28164 by normalizing ambiguous URIs.
11.0.2GitHub ReleaseSummarizedView source
Fixes CVE-2021-28163 by excluding the webapps directory from the deployment scan.
11.0.2GitHub ReleaseSummarizedView source
Addresses and resolves CVE-2020-27223.
11.0.1GitHub ReleaseSummarizedView source
Local Temp Directory Hijacking Vulnerability
High · CVSS 7.0
11.0.0.beta3GitHub AdvisoryOriginalView source
Fixes an open redirect when sending a custom Host header to a URL with no trailing forward-slash.
11.0.0.beta2GitHub ReleaseSummarizedView source
Fixes CWE-331 in the DigestAuthentication class.
DigestAuthentication
11.0.0.beta2GitHub ReleaseSummarizedView source
Platform1
Jetty 11.x requires a minimum of Java 11.
11.0.0GitHub ReleaseSummarizedView source

Deprecations to plan for

Deprecated9
Better document ContextHandler.setCompactPath(boolean) deprecation.
ContextHandler.setCompactPath(boolean)
11.0.25GitHub ReleaseOriginalView source
Deprecate PushCacheFilter.
11.0.18GitHub ReleaseOriginalView source
Deprecate PushSessionCacheFilter.
11.0.16GitHub ReleaseOriginalView source
Remove usages of classes associated with JEP-411 that deprecate/remove the SecurityManager from the JVM.
11.0.15GitHub ReleaseOriginalView source
Deprecate log4j 1.x support.
11.0.8GitHub ReleaseOriginalView source
Add support to deprecate jetty-home modules.
11.0.8GitHub ReleaseOriginalView source
Deprecate UnixSocket JNR support.
11.0.8GitHub ReleaseOriginalView source
Deprecates support for UTF16 encoding in URIs.
11.0.6GitHub ReleaseSummarizedView source
Adds a DeprecationWarning Decorator.
11.0.3GitHub ReleaseSummarizedView source