Repository navigation
[T2.13] Eclipse Jetty 9.4.58 hardening (35 CVEs) #238
Description
Summary
Jetty 10+ requires Java 11+; the 35 catalogued CVEs are pinned at the latest Java 1.8 line. Mitigation: TLS, webdefault.xml hardening, start.ini HTTP config. Closing PRs: #114 (issue #113), #116 (issue #115), #118 (issue #117), #207.
Mitigation matrix
See docs/SECURITY-MITIGATIONS.md T2.13 entry.
Closing evidence
docs/SECURITY-MITIGATIONS.mdT2.13 entryowasp-suppressions.xml- Merged PRs: fix(security): T2.13a hardening: TLS configuration for Jetty 9.4.58 (issue #113) #114, fix(security): T2.13b hardening: webdefault.xml session/cookie/MIME hardening for Jetty 9.4.58 (issue #115) #116, fix(security): T2.13c hardening: start.ini HTTP config hardening for Jetty 9.4.58 (issue #117) #118, fix(jetty): vendor patched upstream/etc/jetty.xml to silence 'Ignored arg' warning #207
Activity
docs(security): bulk backfill owasp-suppressions.xml + SECURITY-MITIG…
fix(security): T2.14 hardening: Hibernate ORM 5.6.15 + Validator 6.2.…
natechadwick-intsof commentedon Sep 17, 2026
Closing this sub-task
Closing in bulk as part of the epic #73 wrap-up. All closing evidence for this sub-task is on
main:docs/SECURITY-MITIGATIONS.mdhas the per-GAV mitigation table for this sub-taskowasp-suppressions.xmlhas per-GAV<suppress>entries with<notes>describing the mitigation, pointing back at this issue and the merged PR(s)No outstanding action items for this sub-task on the Java 1.8 line. Residual CVEs (if any) close on the Java 11+ migration epic.