Package
strimzi-kafka-operator-kafka-thirdparty-libs-cc
Component
jetty-http
Latest update
7.4
CVSS V3
Build, ship, and run secure software with minimal, hardened container images — rebuilt from source daily and guarded under our industry-leading remediation SLA.
Start for freeStatus
Status
Status
Status
Impact
Building with jetty-http updated to a fixed version produces a mixed-version Jetty classpath that crashes Cruise Control at startup with NoClassDefFoundError: org.eclipse.jetty.util.log.Log — Cruise Control 2.5.x is built against Jetty 9.4, and the transitively pulled jetty-util 12.x no longer provides that class. Jetty 9.4 is EOL with no fixed release and Cruise Control does not support Jetty 12, so remediation is pending an upstream Cruise Control move to a supported Jetty version.
Status
Fixed version
1.0.0-r8Status
Impact
The jetty-http vulnerability (GHSA-355h-qmc2-wpwf, CVE-2026-2332) is bundled inside /opt/cruise-control/libs/jetty-http-9.4.56.v20240826.jar at version 9.4.56.v20240826 (shipped with the Cruise Control bundle inside strimzi-kafka-operator-kafka-thirdparty-libs-cc). The named patch in https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf is jetty-http 9.4.60, which has not yet been published — Maven Central returns 404 and the latest jetty/jetty.project release tag is jetty-9.4.58.v20250814. Resolution requires upstream Jetty to ship 9.4.60 and Cruise Control to bump its jetty-http dependency.
Status