Package
cruise-control-jars
Component
jetty-http
Latest update
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Impact
Cruise Control 2.5.146 is built on the Jetty 9.4 line (javax.servlet API) and cannot run on Jetty 12. This package ships jetty-http 9.4.58.v20250814, the latest Jetty 9.4 release published to Maven Central; the Jetty 9.4 release that fixes CVE-2026-19203 (9.4.64) has not been published publicly, and the latest Cruise Control release still depends on Jetty 9.4. Remediation requires either a public Jetty 9.4 release containing the fix or a Cruise Control release that moves to Jetty 12.
Status
Status
Fixed version
2.5.146-r9Status
Impact
Cruise Control 2.5.146 is built on the Jetty 9.4 line (javax.servlet API) and cannot run on Jetty 12. This package already ships jetty-http 9.4.58.v20250814, the latest Jetty 9.4 release published to Maven Central; the Jetty 9.4 release that fixes CVE-2026-19203 (9.4.64) has not been published publicly, and the latest Cruise Control release still depends on Jetty 9.4. Remediation requires either a public Jetty 9.4 release containing the fix or a Cruise Control release that moves to Jetty 12.