Begin forwarded message: From: "Cantor, Scott via announce" <announce(a)shibboleth.net> Subject: Jetty for Windows installer updated to 12.0.20 Date: 12 May 2025 at 16:35:23 CEST To: "announce(a)shibboleth.net" <announce(a)shibboleth.net> Cc: "Cantor, Scott" <cantor.2(a)osu.edu> Reply-To: users(a)shibboleth.net There was a DoS vulnerability [1] in Jetty when HTTP/2 is enabled, which isn't really something we support in our packaging for Windows, but out of caution we have refreshed it to 12.0.20 as it was fairly stale anyway. [2] Monitoring that download point is the main way to keep track but as always, running (and patching) your own container is strongly advised. -- Scott [1] https://www.eclipse.org/lists/jetty-announce/msg00198.html [2] https://shibboleth.net/downloads/identity-provider/jetty-windows/ -- To unsubscribe from this list send an email to announce-unsubscribe(a)shibboleth.net