CVE-2006-6969: Jetty HTTP Server

Medium severity, CVSS 6.8. EPSS: 1.6% chance of exploitation in the next 30 days.

Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3 generates predictable session identifiers using java.util.random, which makes it easier for remote attackers to guess a session identifier through brute force attacks, bypass authentication requirements, and possibly conduct cross-site request forgery attacks.

Affected products

• Jetty Jetty HTTP Server: version 4.2.9 only; version 4.2.11 only; version 4.2.12 only; version 4.2.14 only; version 4.2.15 only; version 4.2.16 only; …

Published 2007-02-07. Last modified 2026-06-16.