Integer overflow in Eclipse Jetty
Priority MEDIUM 57CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Code execution
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 2 fixed, 6 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-190 and the CVSS impact.
Summary
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Why it matters now
EPSS 0.14371 96th percentileScored 2026-11-07
Fix Partial Eclipse Jetty (The Eclipse Foundation): 9.3.24, 9.4.11org.eclipse.jetty:jetty-server (Maven): 9.2.25.v20180606, 9.3.24.v20180605Red Hat: 2 advisoriesRed Hat: 2 fixed, 6 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | up to 9.2.0; 9.3.0 and later; before 9.3.24; 9.4.0 and later; before 9.4.11 | 9.3.24, 9.4.11 | Patch available | CNA |
| — | org.eclipse.jetty:jetty-server (Maven) | before 9.2.25.v20180606 | 9.2.25.v20180606 | Patch available | GHSA-vgg8-72f2-qm23 |
| — | org.eclipse.jetty:jetty-server (Maven) | 9.3.0 to before 9.3.24.v20180605 | 9.3.24.v20180605 | Patch available | GHSA-vgg8-72f2-qm23 |
- Eclipse Jetty VendorEclipse Foundation Affected up to 9.2.0; 9.3.0 and later; before 9.3.24; 9.4.0 and later; before 9.4.11 Fixed in 9.3.24, 9.4.11 Patch available CNA
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected before 9.2.25.v20180606 Fixed in 9.2.25.v20180606 Patch available GHSA-vgg8-72f2-qm23
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.3.0 to before 9.3.24.v20180605 Fixed in 9.3.24.v20180605 Patch available GHSA-vgg8-72f2-qm23
CPE configurations NVD · 25
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | up to 9.2.26; 9.3.0 to before 9.3.24; 9.4.0 to before 9.4.11 | Vulnerable | Eclipse Foundation |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0 – 11.50.1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:element_software_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_storage_nodes:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_system_manager:3.x:*:*:*:*:*:*:* | 3.x | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:* | before 5.2.4 | Vulnerable | NetApp |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions up to 9.2.26; 9.3.0 to before 9.3.24; 9.4.0 to before 9.4.11 Vulnerable ·Eclipse Foundation
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.50.1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:element_software_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_storage_nodes:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_system_manager:3.x:*:*:*:*:*:*:* Versions 3.x Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_unified_manager:*:*:*:*:*:*:*:* Versions before 5.2.4 Vulnerable ·NetApp
Show 15 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:*:*:*:*:*:*:*:* | before 4.3.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:* | before 4.1p3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:* | before 3.4.2 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:* | before 3.4.2 | Vulnerable | NetApp |
| cpe:2.3:a:hp:xp_p9000_command_view:*:*:*:*:advanced:*:*:* | 8.4.0-00 to before 8.6.2-00 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:xp_p9000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* | 11.2.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* | 12.1.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* | 12.2.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* | 18c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | Oracle |
- cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:*:*:*:*:*:*:*:* Versions before 4.3.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:* Versions before 4.1p3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:oracle:*:* Versions before 3.4.2 Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:*:*:*:*:*:sap:*:* Versions before 3.4.2 Vulnerable ·NetApp
- cpe:2.3:a:hp:xp_p9000_command_view:*:*:*:*:advanced:*:*:* Versions 8.4.0-00 to before 8.6.2-00 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:xp_p9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* Versions 11.2.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* Versions 12.1.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* Versions 18c Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
Remediation
- Fix · CNA Eclipse Jetty (The Eclipse Foundation) Fixed in 9.3.24, 9.4.11
- Fix · GHSA-vgg8-72f2-qm23 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.2.25.v20180606 Advisory →
- Fix · GHSA-vgg8-72f2-qm23 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.3.24.v20180605 Advisory →
Red Hat 2 advisories
- RHSA-2020:3779 Released 2020-09-17 · Red Hat rating ImportantRed Hat Data Grid 7.3.7 security update
- Red Hat Data Grid 7.3.7
- RHSA-2019:0910 Released 2019-04-30 · Red Hat rating ImportantRed Hat Fuse 7.3 security update
- Red Hat Fuse 7.3
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
The Eclipse Foundation Eclipse Jetty — DSA-4278
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2017-05294 In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x…Priority MEDIUM 60
- TI-2017-05292 In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x…Priority MEDIUM 42
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 5 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix yet |
| Red Hat Data Grid 7.3.7 | Fixed | RHSA-2020:3779 |
| Red Hat Fuse 7.3 | Fixed | RHSA-2019:0910 |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7657
- 2026-10-03 Alias added: GHSA-vgg8-72f2-qm23
References
Patch 3
Advisory 6
Other 16
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image
- [druid-commits] 20210226 [GitHub] [druid] kingnj opened a new issue #10926: Hello, are there any plans to fix the CVE-2017-7657 and CVE-2017-7658 vulnerabilities of Jetty
- [druid-commits] 20210304 [GitHub] [druid] suneet-s commented on issue #10926: Hello, are there any plans to fix the CVE-2017-7657 and CVE-2017-7658 vulnerabilities of Jetty
- [druid-commits] 20210304 [GitHub] [druid] suneet-s closed issue #10926: Hello, are there any plans to fix the CVE-2017-7657 and CVE-2017-7658 vulnerabilities of Jetty
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574@%3Ccommits.druid.apache.org%3E
- https://security.netapp.com/advisory/ntap-20181014-0001
More Eclipse Foundation Jetty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
- TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
- TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
- TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
- TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
Sources
- CVE-2017-7657 · CVE Program
- CVE-2017-7657 · NVD
- FIRST EPSS
- GHSA-vgg8-72f2-qm23 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-7657 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences