In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x…
Priority MEDIUM 60CWE-444Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · High
- Fix status
- Partial Red Hat: 1 fixed, 7 without a fix
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Why it matters now
EPSS 0.18996 97th percentileScored 2026-11-07
Fix Partial Eclipse Jetty (The Eclipse Foundation): 9.2.25, 9.3.24, 9.4.11org.eclipse.jetty:jetty-server (Maven): 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605Red Hat: 1 advisoryRed Hat: 1 fixed, 7 without a fix
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | before 9.2.25; 9.3.0 and later; before 9.3.24; 9.4.0 and later; before 9.4.11 | 9.2.25, 9.3.24, 9.4.11 | Patch available | CNA |
| — | org.eclipse.jetty:jetty-server (Maven) | before 9.2.25.v20180606 | 9.2.25.v20180606 | Patch available | GHSA-6x9x-8qw9-9pp6 |
| — | org.eclipse.jetty:jetty-server (Maven) | 9.3.0 to before 9.3.24.v20180605 | 9.3.24.v20180605 | Patch available | GHSA-6x9x-8qw9-9pp6 |
| — | org.eclipse.jetty:jetty-server (Maven) | 9.4.0 to before 9.4.11.v20180605 | 9.4.11.v20180605 | Patch available | GHSA-6x9x-8qw9-9pp6 |
- Eclipse Jetty VendorEclipse Foundation Affected before 9.2.25; 9.3.0 and later; before 9.3.24; 9.4.0 and later; before 9.4.11 Fixed in 9.2.25, 9.3.24, 9.4.11 Patch available CNA
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected before 9.2.25.v20180606 Fixed in 9.2.25.v20180606 Patch available GHSA-6x9x-8qw9-9pp6
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.3.0 to before 9.3.24.v20180605 Fixed in 9.3.24.v20180605 Patch available GHSA-6x9x-8qw9-9pp6
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.0 to before 9.4.11.v20180605 Fixed in 9.4.11.v20180605 Patch available GHSA-6x9x-8qw9-9pp6
CPE configurations NVD · 27
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | up to 9.2.26; 9.3.0 to before 9.3.24; 9.4.0 to before 9.4.11 | Vulnerable | Eclipse Foundation |
| cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* | 9.0 | Vulnerable | Debian |
| cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* | 11.2.0.4 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* | 12.1.0.2 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* | 12.2.0.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* | 18c | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_payment:3.3:*:*:*:*:*:*:* | 3.3 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* | 7.1 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* | 15.0 | Vulnerable | Oracle |
| cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* | 16.0 | Vulnerable | Oracle |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions up to 9.2.26; 9.3.0 to before 9.3.24; 9.4.0 to before 9.4.11 Vulnerable ·Eclipse Foundation
- cpe:2.3:o:debian:debian_linux:9.0:*:*:*:*:*:*:* Versions 9.0 Vulnerable ·Debian
- cpe:2.3:a:oracle:rest_data_services:11.2.0.4:*:*:*:-:*:*:* Versions 11.2.0.4 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:12.1.0.2:*:*:*:-:*:*:* Versions 12.1.0.2 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:12.2.0.1:*:*:*:-:*:*:* Versions 12.2.0.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:rest_data_services:18c:*:*:*:-:*:*:* Versions 18c Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_payment:3.3:*:*:*:*:*:*:* Versions 3.3 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:7.1:*:*:*:*:*:*:* Versions 7.1 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:15.0:*:*:*:*:*:*:* Versions 15.0 Vulnerable ·Oracle
- cpe:2.3:a:oracle:retail_xstore_point_of_service:16.0:*:*:*:*:*:*:* Versions 16.0 Vulnerable ·Oracle
Show 17 more CPE
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* | 17.0 | Vulnerable | Oracle |
| cpe:2.3:a:hp:xp_p9000_command_view:*:*:*:*:advanced:*:*:* | 8.4.0-00 – 8.6.2-00 | Vulnerable | Hewlett Packard Enterprise |
| cpe:2.3:h:hp:xp_p9000:-:*:*:*:*:*:*:* | not specified by NVD | Running on | Hewlett Packard Enterprise |
| cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* | 11.0 – 11.50.1 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:hci_storage_node:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* | 3.0 – 3.1.3 | Vulnerable | NetApp |
| cpe:2.3:a:netapp:oncommand_unified_manager_for_7-mode:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:storage_services_connector:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:oracle:retail_xstore_point_of_service:17.0:*:*:*:*:*:*:* Versions 17.0 Vulnerable ·Oracle
- cpe:2.3:a:hp:xp_p9000_command_view:*:*:*:*:advanced:*:*:* Versions 8.4.0-00 – 8.6.2-00 Vulnerable ·Hewlett Packard Enterprise
- cpe:2.3:h:hp:xp_p9000:-:*:*:*:*:*:*:* Versions not specified by NVD Running on ·Hewlett Packard Enterprise
- cpe:2.3:a:netapp:e-series_santricity_management:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0 – 11.50.1 Vulnerable ·NetApp
- cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0 – 3.1.3 Vulnerable ·NetApp
- cpe:2.3:a:netapp:oncommand_unified_manager_for_7-mode:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:storage_services_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · CNA Eclipse Jetty (The Eclipse Foundation) Fixed in 9.2.25, 9.3.24, 9.4.11
- Fix · GHSA-6x9x-8qw9-9pp6 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.2.25.v20180606 Advisory →
- Fix · GHSA-6x9x-8qw9-9pp6 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.3.24.v20180605 Advisory →
- Fix · GHSA-6x9x-8qw9-9pp6 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.11.v20180605 Advisory →
Red Hat 1 advisory
- RHSA-2020:3779 Released 2020-09-17 · Red Hat rating ImportantRed Hat Data Grid 7.3.7 security update
- Red Hat Data Grid 7.3.7
Fixed in the same release
Records fixed by the same vendor advisory or release, as the CNA lists them.
- Advisory ·
The Eclipse Foundation Eclipse Jetty — DSA-4278
3 records Highest priority Priority MEDIUM 3 MEDIUM
Other records, highest priority first
- TI-2017-05293 Integer overflow in Eclipse JettyPriority MEDIUM 57
- TI-2017-05292 In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x…Priority MEDIUM 42
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 6 | Affected | No fix planned: Will not fix |
| Red Hat Enterprise Linux 7 | Affected | No fix yet |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat JBoss Fuse 6 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Fuse Service Works 6 | Affected | No fix planned: Will not fix |
| Red Hat Satellite 5 | Affected | No fix planned: Out of support scope |
| Red Hat Software Collections | Affected | No fix yet |
| Red Hat Data Grid 7.3.7 | Fixed | RHSA-2020:3779 |
Timeline
- 2026-10-02 Threatist record created from CVE-2017-7658
- 2026-10-03 Alias added: GHSA-6x9x-8qw9-9pp6
References
Patch 2
Advisory 7
- DSA-4278
- https://www.oracle.com/security-alerts/cpuoct2020.html
- https://security.netapp.com/advisory/ntap-20181014-0001/
- https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_us
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669
- https://nvd.nist.gov/vuln/detail/CVE-2017-7658
- https://github.com/advisories/GHSA-6x9x-8qw9-9pp6
Other 16
- [lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition Report
- [activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jar
- [druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilities
- [bookkeeper-issues] 20200729 [GitHub] [bookkeeper] padma81 opened a new issue #2387: Security vulnerabilities in the apache/bookkeeper-4.9.2 image
- [druid-commits] 20210226 [GitHub] [druid] kingnj opened a new issue #10926: Hello, are there any plans to fix the CVE-2017-7657 and CVE-2017-7658 vulnerabilities of Jetty
- [druid-commits] 20210304 [GitHub] [druid] suneet-s commented on issue #10926: Hello, are there any plans to fix the CVE-2017-7657 and CVE-2017-7658 vulnerabilities of Jetty
- [druid-commits] 20210304 [GitHub] [druid] suneet-s closed issue #10926: Hello, are there any plans to fix the CVE-2017-7657 and CVE-2017-7658 vulnerabilities of Jetty
- https://www.oracle.com//security-alerts/cpujul2021.html
- https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272@%3Cissues.activemq.apache.org%3E
- https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451@%3Csolr-user.lucene.apache.org%3E
- https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r1b103833cb5bc8466e24ff0ecc5e75b45a705334ab6a444e64e840a0@%3Cissues.bookkeeper.apache.org%3E
- https://lists.apache.org/thread.html/r41af10c4adec8d34a969abeb07fd0d6ad0c86768b751464f1cdd23e8@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/r9159c9e7ec9eac1613da2dbaddbc15691a13d4dbb2c8be974f42e6ae@%3Ccommits.druid.apache.org%3E
- https://lists.apache.org/thread.html/ra6f956ed4ec2855583b2d0c8b4802b450f593d37b77509b48cd5d574@%3Ccommits.druid.apache.org%3E
- https://security.netapp.com/advisory/ntap-20181014-0001
More Eclipse Foundation Jetty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
- TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
- TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
- TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
- TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
Sources
- CVE-2017-7658 · CVE Program
- CVE-2017-7658 · NVD
- FIRST EPSS
- GHSA-6x9x-8qw9-9pp6 · GitHub Advisory Database · CC BY 4.0
- CVE-2017-7658 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences