Merge remote-tracking branch 'origin/jetty-11.0.x' into jetty-12.0.x

VERSION.txt

@@ -74,10 +74,13 @@ jetty-10.0.24 - 26 August 2024
  + 12201 backport ThreadLimitHandler improvements from Jetty 12
 
 jetty-11.0.24 - 26 August 2024
- + 12201 backport ThreadLimitHandler improvements from Jetty 12
+ + 12201 backport ThreadLimitHandler improvements from Jetty 12 (CVE-2024-8184)
+
+jetty-10.0.24 - 26 August 2024
+ + 12201 backport ThreadLimitHandler improvements from Jetty 12 (CVE-2024-8184)
 
 jetty-9.4.56.v20240826 - 26 August 2024
- + 12200 Backport ThreadLimitHandler improvements from Jetty 12
+ + 12200 Backport ThreadLimitHandler improvements from Jetty 12 (CVE-2024-8184)
 
 jetty-11.0.23 - 13 August 2024
  + 12041 backport tracking retainable pool from Jetty 12
@@ -278,7 +281,7 @@ jetty-12.0.7 - 29 February 2024
  + 11465 HttpURI.toURI() sets userInfo to null
 
 jetty-9.4.54.v20240208 - 08 February 2024
- + 1256 DoSFilter leaks USER_AUTH entries
+ + 1256 DoSFilter leaks USER_AUTH entries (CVE-2024-9823)
  + 11259 HTTP/2 connection not closed after idle timeout when TCP congested
    (CVE-2024-22201)
  + 11389 Strip default ports on ws/wss scheme uris too
@@ -373,7 +376,7 @@ jetty-11.0.19 - 15 December 2023
  + 11014 RedirectRegexRule and RewritePatternRule should consider
    relativeRedirectAllowed
  + 11031 HttpClient should expose Connection/EndPoint used by HTTP requests
- + 11039 Memory leak and multiple (Http|Servlet)*Listener invokations after
+ + 11039 Memory leak and multiple (Http|Servlet)*Listener invocations after
    restart
  + 11044 Update jetty-11 to apache jasper 10.0.27
 
@@ -385,7 +388,7 @@ jetty-10.0.19 - 15 December 2023
  + 11014 RedirectRegexRule and RewritePatternRule should consider
    relativeRedirectAllowed
  + 11031 HttpClient should expose Connection/EndPoint used by HTTP requests
- + 11039 Memory leak and multiple (Http|Servlet)*Listener invokations after
+ + 11039 Memory leak and multiple (Http|Servlet)*Listener invocations after
    restart
  + 11043 Update to apache jasper 9.0.83
 
@@ -446,7 +449,8 @@ jetty-12.0.3 - 26 October 2023
  + 10794 301 Moved Permanently produces query with `;` instead of `?`
 
 jetty-11.0.18 - 26 October 2023
- + 1256 DoSFilter leaks USER_AUTH entries
+ + 1256 DoSFilter leaks USER_AUTH entries (CVE-2024-9823)
+ + 9715 Deprecate PushSessionCacheFilter (CVE-2024-6762)
  + 10390 Jetty HTTP/3 Client fails when connecting to `nghttpx` server
  + 10519 java.lang.IllegalStateException: Flusher when using HTTP/3 with Spring
    Boot 3.2
@@ -461,7 +465,8 @@ jetty-11.0.18 - 26 October 2023
  + 10786 TLS handshake failures leak HttpConnection.RequestTimeouts tasks
 
 jetty-10.0.18 - 26 October 2023
- + 1256 DoSFilter leaks USER_AUTH entries
+ + 1256 DoSFilter leaks USER_AUTH entries (CVE-2024-9823)
+ + 9715 Deprecate PushSessionCacheFilter (CVE-2024-6762)
  + 10390 Jetty HTTP/3 Client fails when connecting to `nghttpx` server
  + 10519 java.lang.IllegalStateException: Flusher when using HTTP/3 with Spring
    Boot 3.2