In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large…
Priority MEDIUM 54CWE-672Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- High · High · Low
- Fix status
- Fixed
Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgraded, the vulnerability can be significantly reduced by configuring a responseHeaderSize significantly larger than the requestHeaderSize (12KB responseHeaderSize and 8KB requestHeaderSize).
Why it matters now
EPSS 0.11138 95th percentileScored 2026-11-07
Fix Fixed org.eclipse.jetty:jetty-server (Maven): 9.4.30.v20200611Red Hat: 5 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | 9.4.27.v20200227 to 9.4.29.v20200521 | — | No fix listed | CNA |
| — | org.eclipse.jetty:jetty-server (Maven) | 9.4.27 to before 9.4.30.v20200611 | 9.4.30.v20200611 | Patch available | GHSA-x3rh-m7vp-35f2 |
- Eclipse Jetty VendorEclipse Foundation Affected 9.4.27.v20200227 to 9.4.29.v20200521 Fixed in — No fix listed CNA
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.27 to before 9.4.30.v20200611 Fixed in 9.4.30.v20200611 Patch available GHSA-x3rh-m7vp-35f2
CPE configurations NVD · 3
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:9.4.27:20200227:*:*:*:*:*:* | 9.4.27 20200227 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:jetty:9.4.28:20200408:*:*:*:*:*:* | 9.4.28 20200408 | Vulnerable | Eclipse Foundation |
| cpe:2.3:a:eclipse:jetty:9.4.29:20200521:*:*:*:*:*:* | 9.4.29 20200521 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:jetty:9.4.27:20200227:*:*:*:*:*:* Versions 9.4.27 20200227 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:jetty:9.4.28:20200408:*:*:*:*:*:* Versions 9.4.28 20200408 Vulnerable ·Eclipse Foundation
- cpe:2.3:a:eclipse:jetty:9.4.29:20200521:*:*:*:*:*:* Versions 9.4.29 20200521 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-x3rh-m7vp-35f2 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.30.v20200611 Advisory →
Red Hat 5 advisories
- RHSA-2020:5568 Released 2020-12-16 · Red Hat rating ImportantRed Hat Fuse 7.8.0 release and security update
- Red Hat Fuse 7.8.0
- RHSA-2020:4223 Released 2020-10-22 · Red Hat rating ImportantOpenShift Container Platform 3.11.306 jenkins security update
- Red Hat OpenShift Container Platform 3.11 jenkins-2.235.5.1600415953-1.el7
- RHSA-2020:4220 Released 2020-10-13 · Red Hat rating ImportantOpenShift Container Platform 4.4.27 openshift-jenkins-2-container security update
- Red Hat OpenShift Container Platform 4.4 openshift4/ose-jenkins
Show 2 more Red Hat advisories
- RHSA-2020:3841 Released 2020-09-30 · Red Hat rating ImportantOpenShift Container Platform 4.5.13 jenkins security update
- Red Hat OpenShift Container Platform 4.5 jenkins-2.235.5.1600414805-1.el7
- RHSA-2020:3808 Released 2020-09-23 · Red Hat rating ImportantOpenShift Container Platform 4.3.38 jenkins and openshift security update
- Red Hat OpenShift Container Platform 4.3 jenkins-2.235.5.1600415514-1.el7, openshift-4.3.37-202009120213.p0.git.0.dffefe4.el8, openshift-hyperkube-4.3.37-202009120213.p0.git.0.dffefe4.el8
Vendor assessments
Red Hat
Red Hat rating: Important. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Fuse 7.8.0 | Fixed | RHSA-2020:5568 |
| Red Hat OpenShift Container Platform 3.11 | Fixed | RHSA-2020:4223 |
| Red Hat OpenShift Container Platform 4.3 | Fixed | RHSA-2020:3808 |
| Red Hat OpenShift Container Platform 4.4 | Fixed | RHSA-2020:4220 |
| Red Hat OpenShift Container Platform 4.5 | Fixed | RHSA-2020:3841 |
| Red Hat OpenShift Container Platform 4.6 | Fixed | — |
Not affected: 7 products
- Red Hat Enterprise Linux 6
- Red Hat Enterprise Linux 7
- Red Hat JBoss Fuse 6
- Red Hat JBoss Fuse Service Works 6
- Red Hat OpenShift Container Platform 4.3
- Red Hat Single Sign-On 7
- Red Hat Software Collections
Timeline
- 2026-10-02 Threatist record created from CVE-2019-17638
- 2026-10-03 Alias added: GHSA-x3rh-m7vp-35f2
- 2026-10-30 Fix available: Red Hat OpenShift Container Platform 4.6 · Red Hat
References
Advisory 3
Other 30
- [oss-security] 20200817 Vulnerability in Jenkins
- [pulsar-commits] 20200903 [GitHub] [pulsar] guyv opened a new issue #7970: pulsar-client vulnerability CVE-2019-17638
- [pulsar-commits] 20200911 [GitHub] [pulsar] codelipenghui closed issue #7970: pulsar-client vulnerability CVE-2019-17638
- [pulsar-commits] 20200912 [GitHub] [pulsar] codelipenghui closed issue #7970: pulsar-client vulnerability CVE-2019-17638
- [pulsar-commits] 20200914 [GitHub] [pulsar] klwilson227 opened a new issue #8060: CVE-2019-17638 jetty server
- [pulsar-commits] 20200922 [GitHub] [pulsar] zymap commented on issue #8060: CVE-2019-17638 jetty server
- [pulsar-commits] 20200923 [GitHub] [pulsar] zymap commented on issue #8060: CVE-2019-17638 jetty server
- [pulsar-commits] 20200929 [GitHub] [pulsar] sijie closed issue #8060: CVE-2019-17638 jetty server
- [pulsar-commits] 20200929 [GitHub] [pulsar] sijie commented on issue #8060: CVE-2019-17638 jetty server
- [pulsar-commits] 20201005 [GitHub] [pulsar] abhishekheaven7 opened a new issue #8203: Pulsar client with version 2.6.1 has critical vulnerability CVE-2019-17638
- [pulsar-commits] 20201005 [GitHub] [pulsar] abhishekheaven7 closed issue #8203: Pulsar client with version 2.6.1 has critical vulnerability CVE-2019-17638
- https://www.oracle.com/security-alerts/cpuoct2020.html
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list
- [pulsar-commits] 20210127 [GitHub] [pulsar] GLouMcK opened a new issue #9347: Security Vulnerabilities - Black Duck Scan
- https://www.oracle.com/security-alerts/cpuApr2021.html
- https://github.com/eclipse/jetty.project/issues/4936
- https://github.com/eclipse/jetty.project/commit/ff8ae56fa939c3477a0cdd1ff56ce3d902f08fba
- https://lists.fedoraproject.org/archives/list/[email protected]/message/XE6US6VPZHOWFMUSFGDS5V2DNQPY5MKB
- https://lists.apache.org/thread.html/rd98cfd012490cb02caa1a11aaa0cc38bff2d43bcce9b20c2f01063dd@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rd0e44e8ef71eeaaa3cf3d1b8b41eb25894372e2995ec908ce7624d26@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/rbe1f230e87ea947593145d0072d0097ddb0af10fee1161db8ca1546c@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/ra8661fc8c69c647cb06153c1485d48484a833d873f75dfe45937e9de@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r9a2cfa56d30782a0c17a5deb951a622d1f5c8de48e1c3b578ffc2a84@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r9584c4304c888f651d214341a939bd264ed30c9e3d0d30fe85097ecf@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r81f58591fb4716fb867b36956f30c7c8ad4ab3f23abc952d9d86a2a0@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r7fc5f2ed49641ea91c433e3cd0fc3d31c0278c87b82b15c33b881415@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r521168299e023fb075b57afe33d17ff1d09e8a10e0fd8c775ea0e028@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r4bdd3f7bb6820a79f9416b6667d718a06d269018619a75ce4b759318@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r378e4cdec15e132575aa1dcb6296ffeff2a896745a8991522e266ad4@%3Ccommits.pulsar.apache.org%3E
- https://lists.apache.org/thread.html/r29073905dc9139d0d7a146595694bf57bb9e35e5ec6aa73eb9c8443a@%3Ccommits.pulsar.apache.org%3E
More Eclipse Foundation Jetty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
- TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
- TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
- TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
- TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
Sources
- CVE-2019-17638 · CVE Program
- CVE-2019-17638 · NVD
- FIRST EPSS
- GHSA-x3rh-m7vp-35f2 · GitHub Advisory Database · CC BY 4.0
- CVE-2019-17638 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences