[
https://issues.apache.org/jira/browse/ZOOKEEPER-5038?page=com.atlassian.jira.plugin.system.issuetabpanels:comment-tabpanel&focusedCommentId=18074816#comment-18074816
]
Dávid Paksy commented on ZOOKEEPER-5038:
----------------------------------------
Currently we use 9.4.58.v20250814 from Jetty. There seems to be no newer of not
vulnerable release form the 9.x line. The 9.x line is End Of Life / Unsupported.
Jetty 10 and 11 lines are also EOL / Unsupported.
Jetty 12.x is Stable / supported line but that requires Java 17 as minimum JVM
version. In master branch we have min Java 17 requirement so we could update
Jetty in master to 12.x.
12.0.34 is the next non-vulnerable version which we could upgrade to.
h3. Two Approaches for Jetty 12 Migration
h4. Option 1: EE8 (keep javax.servlet)
Use jetty-ee8-servlet artifacts — Jetty 12's compatibility layer for
javax.servlet.
Pros:
- ~25 files with javax.servlet imports stay untouched
- AuthenticationProvider interface + all implementations unchanged
- Prometheus exporter stays on prometheus-metrics-exporter-servlet-javax
- Smaller diff, lower risk
Cons:
- EE8 is a compatibility shim — may be dropped in future Jetty versions
- Still requires updating core Jetty APIs (AbstractHandler, client.api,
EndPoint, SslConnection)
- Keeps the project on an older servlet spec (Servlet 4.0)
h4. Option 2: EE10 (migrate to jakarta.servlet)
Use jetty-ee10-servlet artifacts and rename all servlet imports.
Pros:
- Future-proof — aligned with Jakarta EE 10 / Servlet 6.0
- No dependency on a compatibility layer
- Modern ecosystem alignment (Spring 6, Tomcat 10+, etc.)
Cons:
- Touches ~25+ additional files for javax.servlet → jakarta.servlet rename
- Requires changing AuthenticationProvider interface signature (public API)
- Prometheus exporter must switch to
prometheus-metrics-exporter-servlet-jakarta
- Larger blast radius, more potential for regressions
Most probably choosing option 1: EE8 (keep javax.servlet) is less risky.
> Upgrade Jetty to address CVE-2026-2332
> --------------------------------------
>
> Key: ZOOKEEPER-5038
> URL: https://issues.apache.org/jira/browse/ZOOKEEPER-5038
> Project: ZooKeeper
> Issue Type: Task
> Components: server
> Affects Versions: 3.9.5, 3.8.6
> Reporter: Jota Martos
> Priority: Major
>
> Jetty versions lower than 9.4.60 are affected by this CVE.
> bq. Jetty incorrectly parses quoted strings in HTTP/1.1 chunked transfer
> encoding extension values, enabling request smuggling attacks.
> You can find more information in the [security
> advisory|https://github.com/jetty/jetty.project/security/advisories/GHSA-355h-qmc2-wpwf].
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
