p PatchFirst

CVE-2020-27223

CVE-2020-27223

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

CVSS 5.2 · Medium · EPSS 78.0% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • eclipse jetty

    Versions
    • ≥ 9.4.6.v20170531, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 9.4.36.v20210114: Affected (custom)
    • 10.0.0: Affected
    • 11.0.0: Affected

    No fix published

  • jetty9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.4.38-1

    Update to 9.4.38-1

  • jetty9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.4.38-1

    Update to 9.4.38-1

  • jetty9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.4.38-1

    Update to 9.4.38-1

  • jetty9 Ubuntu:16.04:LTS

    Versions
    • 9.2.14-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:18.04:LTS

    Versions
    • 9.2.22-2
    • 9.2.22-3
    • 9.2.23-1
    • 9.4.15-1~18.04.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:20.04:LTS

    Versions
    • 9.4.18-2build2
    • 9.4.26-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:22.04:LTS

    Versions
    • 9.4.39-3
    • 9.4.44-2
    • 9.4.44-3
    • 9.4.44-4
    • 9.4.45-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →