CVE-2019-17638

CVE-2019-17638 is a critical vulnerability affecting Eclipse Jetty versions 9.4.27.v20200227 to 9.4.29.v20200521. It arises from a double-free error in the ByteBufferPool when handling oversized response headers, leading to two threads acquiring the same buffer. This allows sensitive data from one client's request (e.g., session IDs, credentials) to be inadvertently sent to another client. With a CVSS score of 9.4 (CRITICAL), it is a network-exploitable vulnerability with low attack complexity, posing a high risk of confidentiality and integrity compromise, and a low impact on availability. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.