deardaniel/secdata-raw huggingface dataset:
GitHub Security Advisory: GHSA-fpj8-gq4v-p354
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-295: Improper Certificate Validation
Vulnerable versions: < 9.0.113
Patched in: 9.0.113

Summary: Apache Tomcat - Client certificate verification bypass

Details:
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.
GitHub Security Advisory: GHSA-fpj8-gq4v-p354
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 10.1.0-M1, < 10.1.50
Patched in: 10.1.50

Summary: Apache Tomcat - Client certificate verification bypass

Details:
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.
GitHub Security Advisory: GHSA-fpj8-gq4v-p354
Package: org.apache.tomcat:tomcat (MAVEN)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 11.0.0-M1, < 11.0.15
Patched in: 11.0.15

Summary: Apache Tomcat - Client certificate verification bypass

Details:
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.
GitHub Security Advisory: GHSA-fpj8-gq4v-p354
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-295: Improper Certificate Validation
Vulnerable versions: < 9.0.113
Patched in: 9.0.113

Summary: Apache Tomcat - Client certificate verification bypass

Details:
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.
GitHub Security Advisory: GHSA-fpj8-gq4v-p354
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 10.1.0-M1, < 10.1.50
Patched in: 10.1.50

Summary: Apache Tomcat - Client certificate verification bypass

Details:
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.
GitHub Security Advisory: GHSA-fpj8-gq4v-p354
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: MODERATE (CVSS 9.1)
CWE: CWE-20: Improper Input Validation, CWE-295: Improper Certificate Validation
Vulnerable versions: >= 11.0.0-M1, < 11.0.15
Patched in: 11.0.15

Summary: Apache Tomcat - Client certificate verification bypass

Details:
Improper Input Validation vulnerability.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.14, from 10.1.0-M1 through 10.1.49, from 9.0.0-M1 through 9.0.112.

The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Older EOL versions are not affected. Tomcat did not validate that the host name provided via the SNI extension was the same as the host name provided in the HTTP host header field. If Tomcat was configured with more than one virtual host and the TLS configuration for one of those hosts did not require client certificate authentication but another one did, it was possible for a client to bypass the client certificate authentication by sending different host names in the SNI extension and the HTTP host header field.

The vulnerability only applies if client certificate authentication is only enforced at the Connector. It does not apply if client certificate authentication is enforced at the web application.

Users are recommended to upgrade to version 11.0.15 or later, 10.1.50 or later or 9.0.113 or later, which fix the issue.
GitHub Security Advisory: GHSA-7c3f-cg9x-f3gr
Package: net.sf.jasperreports:jasperreports (MAVEN)
Severity: HIGH (CVSS 9.8)
CWE: CWE-502: Deserialization of Untrusted Data
Vulnerable versions: < 7.0.4
Patched in: 7.0.4

Summary: JasperReports has a Java deserialisation vulnerability

Details:
A Java deserialisation vulnerability has been discovered in the Jaspersoft Library. Improper handling of externally supplied data may allow attackers to execute arbitrary code remotely on systems that use the affected library.
GitHub Security Advisory: GHSA-crhr-qqj8-rpxc
Package: org.apache.zookeeper:zookeeper (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 3.8.0, < 3.8.6
Patched in: 3.8.6

Summary: Apache ZooKeeper has improper handling of configuration values

Details:
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
GitHub Security Advisory: GHSA-crhr-qqj8-rpxc
Package: org.apache.zookeeper:zookeeper (MAVEN)
Severity: HIGH (CVSS 0.0)
CWE: CWE-532: Insertion of Sensitive Information into Log File
Vulnerable versions: >= 3.9.0, < 3.9.5
Patched in: 3.9.5

Summary: Apache ZooKeeper has improper handling of configuration values

Details:
Improper handling of configuration values in ZKConfig in Apache ZooKeeper 3.8.5 and 3.9.4 on all platforms allows an attacker to expose sensitive information stored in client configuration in the client's logfile. Configuration values are exposed at INFO level logging rendering potential production systems affected by the issue. Users are recommended to upgrade to version 3.8.6 or 3.9.5 which fixes this issue.
GitHub Security Advisory: GHSA-6wcw-r64p-qrrw
Package: org.cloudfoundry.identity:cloudfoundry-identity-server (MAVEN)
Severity: MODERATE (CVSS 6.5)
Vulnerable versions: >= 77.30.0, < 78.8.0
Patched in: 78.8.0

Summary: Cloudfoundry UAA has logic error in the token revocation endpoint implementation

Details:
Inappropriate user token revocation due to a logic error in the token revocation endpoint implementation in Cloudfoundry UAA v77.30.0 to v78.7.0 and in Cloudfoundry Deployment v48.7.0 to v54.10.0.
GitHub Security Advisory: GHSA-8cr3-vpxx-92cx
Package: org.keycloak:keycloak-broker-saml (MAVEN)
Severity: HIGH (CVSS 8.8)
CWE: CWE-305: Authentication Bypass by Primary Weakness
Vulnerable versions: <= 1.8.1.Final
Patched in: unpatched

Summary: Keycloak SAML Broken has Authentication Bypass by Primary Weakness

Details:
A flaw was found in org.keycloak.broker.saml. When a disabled Security Assertion Markup Language (SAML) client is configured as an Identity Provider (IdP)-initiated broker landing target, it can still complete the login process and establish a Single Sign-On (SSO) session. This allows a remote attacker to gain unauthorized access to other enabled clients without re-authentication, effectively bypassing security restrictions.

A fix is available at https://github.com/keycloak/keycloak/releases/tag/26.5.5.
GitHub Security Advisory: GHSA-m297-3jv9-m927
Package: org.keycloak:keycloak-services (MAVEN)
Severity: HIGH (CVSS 8.1)
CWE: CWE-285: Improper Authorization, CWE-863: Incorrect Authorization
Vulnerable versions: < 26.5.5
Patched in: 26.5.5

Summary: Keycloak allows authentication using an Identity Provider (IdP) even after it has been disabled by an administrator

Details:
A security flaw in the IdentityBrokerService.performLogin endpoint of Keycloak allows authentication to proceed using an Identity Provider (IdP) even after it has been disabled by an administrator. An attacker who knows the IdP alias can reuse a previously generated login request to bypass the administrative restriction. This undermines access control enforcement and may allow unauthorized authentication through a disabled external provider.
GitHub Security Advisory: GHSA-wr62-c79q-cv37
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 8.5.0, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits

Details:
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
GitHub Security Advisory: GHSA-wr62-c79q-cv37
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 9.0.0.M1, < 9.0.107
Patched in: 9.0.107

Summary: Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits

Details:
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
GitHub Security Advisory: GHSA-wr62-c79q-cv37
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 10.1.0-M1, < 10.1.43
Patched in: 10.1.43

Summary: Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits

Details:
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
GitHub Security Advisory: GHSA-wr62-c79q-cv37
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-190: Integer Overflow or Wraparound
Vulnerable versions: >= 11.0.0-M1, < 11.0.9
Patched in: 11.0.9

Summary: Apache Tomcat Catalina is vulnerable to DoS attack through bypassing of size limits

Details:
For some unlikely configurations of multipart upload, an Integer Overflow vulnerability in Apache Tomcat could lead to a DoS via bypassing of size limits.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100. Other, older, EOL versions may also be affected.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
GitHub Security Advisory: GHSA-25xr-qj8w-c4vf
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 11.0.0-M1, < 11.0.9
Patched in: 11.0.9

Summary: Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Details:
Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
GitHub Security Advisory: GHSA-25xr-qj8w-c4vf
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 10.1.0-M1, < 10.1.43
Patched in: 10.1.43

Summary: Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Details:
Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
GitHub Security Advisory: GHSA-25xr-qj8w-c4vf
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 9.0.0.M1, < 9.0.107
Patched in: 9.0.107

Summary: Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Details:
Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
GitHub Security Advisory: GHSA-25xr-qj8w-c4vf
Package: org.apache.tomcat.embed:tomcat-embed-core (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption
Vulnerable versions: >= 8.5.0, <= 8.5.100
Patched in: unpatched

Summary: Apache Tomcat Coyote vulnerable to Denial of Service via excessive HTTP/2 streams

Details:
Uncontrolled Resource Consumption vulnerability in Apache Tomcat if an HTTP/2 client did not acknowledge the initial settings frame that reduces the maximum permitted concurrent streams.

This issue affects Apache Tomcat: from 11.0.0-M1 through 11.0.8, from 10.1.0-M1 through 10.1.42, from 9.0.0.M1 through 9.0.106. The following versions were EOL at the time the CVE was created but are known to be affected: 8.5.0 through 8.5.100.

Users are recommended to upgrade to version 11.0.9, 10.1.43 or 9.0.107, which fix the issue.
GitHub Security Advisory: GHSA-pm7g-w2cf-q238
Package: org.pac4j:pac4j-jwt (MAVEN)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: < 4.5.9
Patched in: 4.5.9

Summary: pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

Details:
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
GitHub Security Advisory: GHSA-pm7g-w2cf-q238
Package: org.pac4j:pac4j-jwt (MAVEN)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 5.0.0-RC1, < 5.7.9
Patched in: 5.7.9

Summary: pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

Details:
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
GitHub Security Advisory: GHSA-pm7g-w2cf-q238
Package: org.pac4j:pac4j-jwt (MAVEN)
Severity: CRITICAL (CVSS 10.0)
CWE: CWE-347: Improper Verification of Cryptographic Signature
Vulnerable versions: >= 6.0.4.1, < 6.3.3
Patched in: 6.3.3

Summary: pac4j-jwt: JwtAuthenticator Authentication Bypass via JWE-Wrapped PlainJWT

Details:
pac4j-jwt versions prior to 4.5.9, 5.7.9, and 6.3.3 contain an authentication bypass vulnerability in JwtAuthenticator when processing encrypted JWTs that allows remote attackers to forge authentication tokens. Attackers who possess the server's RSA public key can create a JWE-wrapped PlainJWT with arbitrary subject and role claims, bypassing signature verification to authenticate as any user including administrators.
GitHub Security Advisory: GHSA-xxh7-fcf3-rj7f
Package: org.eclipse.jetty:jetty-server (MAVEN)
Severity: HIGH (CVSS 7.5)
CWE: CWE-400: Uncontrolled Resource Consumption, CWE-401: Missing Release of Memory after Effective Lifetime
Vulnerable versions: >= 12.0.0, <= 12.0.31
Patched in: 12.0.32

Summary: The Eclipse Jetty Server Artifact has a Gzip request memory leak 

Details:
### Description (as reported)

There is a memory leak when using `GzipHandler` in jetty-12.0.30 that can cause off-heap OOMs. This can be used for DoS attacks so I'm reporting this as a vulnerability.

The leak is created by requests where the request is inflated (`Content-Encoding: gzip`) and the response is not deflated (no `Accept-Encoding: gzip`). In these conditions, a new inflator will be created by `GzipRequest` and never released back into `GzipRequest.__inflaterPool` because `gzipRequest.destory()` is not called.

In heap dumps one can see thousands of `java.util.zip.Inflator` objects, which use both Java heaps and native memory. Leaking native memory causes of off-heap OOMs.

Code path in `GzipHandler.handle()`:
1. Line 601: `GzipRequest` is created when request inflation is needed.
2. Lines 611-616: The callback is only wrapped in `GzipResponseAndCallback` when both inflation and deflation are needed.
3. Lines 619-625: If the handler accepts the request (returns true), `gzipRequest.destroy()` is only called in the "request not accepted" path (returns false)

When deflation is needed, `GzipResponseAndCallback` (lines 102 and 116) properly calls `gzipRequest.destroy()` in its `succeeded()` and `failed()` methods. But this wrapper is only created when deflation is needed.

Possible fix:
The callback should be wrapped whenever a `GzipRequest` is created, not just when deflation is needed. This ensures `gzipRequest.destroy()` is always called when the request completes.


### Impact
The leak causes the JVM to crash with OOME.

### Patches
No patches yet.

### Workarounds
Disable `GzipHandler`.

### References
https://github.com/jetty/jetty.project/issues/14260

https://gitlab.eclipse.org/security/cve-assignment/-/issues/79