Jetty 9.4.x Release Notes

3 versions

Comprehensive release notes and changelog for Jetty 9.4.x, including security patches, bug fixes, and feature updates across all supported versions.

Apr 10, 2026

Latest: 9.4.61

9 Patched Vulnerabilities

April 2026

Released Apr 10, 2026

Full Version:

9.4.61

This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 9.4.58.

Released Mar 6, 2026

Full Version:

9.4.60

HTTP Request Smuggling via Chunked Extension Quoted-String Parsing (CVE-2026-2332).

This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 9.4.58.

Released Mar 5, 2026

Full Version:

9.4.59

Fixed improper input validation in jetty-http where malformed URIs were parsed differently than other common parsers, potentially allowing blocklist bypass in multi-component systems (CVE-2025-11143).

This release originates from the open-source Eclipse Jetty by HeroDevs. It encompasses modifications implemented by HeroDevs to ensure successful framework builds. This release contains no functional changes from Jetty 9.4.58.

~/herodevs-spring-framework-support

When official support ends, we're just getting started.

New releases published regularly — check back often for the latest security updates

$ cat features.txt