Read the docs
TI-2020-16544 Aliases CVE-2020-27218GHSA-86wm-rrjm-8wh8

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2…

Priority LOW 33CWE-226Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
High
Impact type
—
Confidentiality · integrity · availability
None · Low · Low
Fix status
Partial Red Hat: 10 fixed, 6 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

Why it matters now

EPSS 0.08277 94th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-server (Maven): 9.4.35.v20201120Red Hat: 8 advisoriesRed Hat: 10 fixed, 6 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty9.4.0.RC0 to 9.4.34.v20201102; 10.0.0.alpha0 to 10.0.0.beta2; 11.0.0.alpha0 to 11.0.0.beta2—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)9.4.0 to before 9.4.35.v202011209.4.35.v20201120Patch availableGHSA-86wm-rrjm-8wh8
  • Eclipse Jetty VendorEclipse Foundation Affected 9.4.0.RC0 to 9.4.34.v20201102; 10.0.0.alpha0 to 10.0.0.beta2; 11.0.0.alpha0 to 11.0.0.beta2 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.0 to before 9.4.35.v20201120 Fixed in 9.4.35.v20201120 Patch available GHSA-86wm-rrjm-8wh8

CPE configurations NVD · 27

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.4.0 to before 9.4.35VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:alpha0:*:*:*:*:*:*10.0.0 alpha0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:alpha1:*:*:*:*:*:*10.0.0 alpha1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:beta0:*:*:*:*:*:*10.0.0 beta0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:beta1:*:*:*:*:*:*10.0.0 beta1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:beta2:*:*:*:*:*:*10.0.0 beta2VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:11.0.0:alpha0:*:*:*:*:*:*11.0.0 alpha0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:11.0.0:beta1:*:*:*:*:*:*11.0.0 beta1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:11.0.0:beta2:*:*:*:*:*:*11.0.0 beta2VulnerableEclipse Foundation
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*3.0 – 3.1.3VulnerableNetApp
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.4.0 to before 9.4.35 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:alpha0:*:*:*:*:*:* Versions 10.0.0 alpha0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:alpha1:*:*:*:*:*:* Versions 10.0.0 alpha1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:beta0:*:*:*:*:*:* Versions 10.0.0 beta0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:beta1:*:*:*:*:*:* Versions 10.0.0 beta1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:beta2:*:*:*:*:*:* Versions 10.0.0 beta2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:11.0.0:alpha0:*:*:*:*:*:* Versions 11.0.0 alpha0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:11.0.0:beta1:*:*:*:*:*:* Versions 11.0.0 beta1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:11.0.0:beta2:*:*:*:*:*:* Versions 11.0.0 beta2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:* Versions 3.0 – 3.1.3 Vulnerable ·NetApp
Show 17 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*before 21.1.2VulnerableOracle
cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:*6.2VulnerableOracle
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*12.0.0.3.0VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*8.0.0 – 8.2.4VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*12.0.0VulnerableOracle
cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*12.1.0VulnerableOracle
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.6.0:*:*:*:*:*:*:*11.1.2.6.0VulnerableOracle
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*before 20.4.3.050.1904VulnerableOracle
cpe:2.3:a:oracle:retail_eftlink:20.0.0:*:*:*:*:*:*:*20.0.0VulnerableOracle
cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:*up to 21.5VulnerableOracle
cpe:2.3:a:apache:kafka:2.7.0:*:*:*:*:*:*:*2.7.0VulnerableApache
cpe:2.3:a:apache:spark:2.4.8:*:*:*:*:*:*:*2.4.8VulnerableApache
cpe:2.3:a:apache:spark:3.0.3:*:*:*:*:*:*:*3.0.3VulnerableApache
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
  • cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:* Versions before 21.1.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:* Versions 6.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:* Versions 12.0.0.3.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.0.0 – 8.2.4 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:* Versions 12.1.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.6.0:*:*:*:*:*:*:* Versions 11.1.2.6.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* Versions before 20.4.3.050.1904 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:retail_eftlink:20.0.0:*:*:*:*:*:*:* Versions 20.0.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:* Versions up to 21.5 Vulnerable ·Oracle
  • cpe:2.3:a:apache:kafka:2.7.0:*:*:*:*:*:*:* Versions 2.7.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:2.4.8:*:*:*:*:*:*:* Versions 2.4.8 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:3.0.3:*:*:*:*:*:*:* Versions 3.0.3 Vulnerable ·Apache
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-86wm-rrjm-8wh8 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.35.v20201120 Advisory →

Red Hat 8 advisories

  • RHSA-2022:1029 Released 2022-03-23 · Red Hat rating Important
    Red Hat Integration Camel-K 1.6.4 release and security update
    • RHINT Camel-K 1.6.4
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:4767 Released 2021-11-23 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus GA security update
    • Red Hat Integration Camel Quarkus 2
Show 5 more Red Hat advisories
  • RHSA-2021:2431 Released 2021-07-02 · Red Hat rating Important
    OpenShift Container Platform 4.5.41 security update
    • Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins-4.5.1623326336-1.el7, jenkins-2.277.3.1623846768-1.el7
  • RHSA-2021:2517 Released 2021-06-30 · Red Hat rating Important
    OpenShift Container Platform 3.11.462 bug fix and security update
    • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins-3.11.1624366838-1.el7, jenkins-2.289.1.1624365627-1.el7
  • RHSA-2021:2499 Released 2021-06-29 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.36 security update
    • Red Hat OpenShift Container Platform 4.6 jenkins-2.277.3.1623853726-1.el8
  • RHSA-2021:0417 Released 2021-02-04 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.8.1 release and security update
    • Red Hat AMQ 7.8.1
  • RHSA-2021:0329 Released 2021-02-02 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.4.6 release and security update
    • Red Hat AMQ LTS 7.4.6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
7Server-RHMTC-1.4Fixed—
8Base-RHMTC-1.4Fixed—
RHINT Camel-K 1.6.4Fixed RHSA-2022:1029
Red Hat AMQ 7.8.1Fixed RHSA-2021:0417
Red Hat AMQ LTS 7.4.6Fixed RHSA-2021:0329
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:4767
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2021:2517
Red Hat OpenShift Container Platform 4.5Fixed RHSA-2021:2431
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:2499
Not affected: 8 products
  • Red Hat Decision Manager 7
  • Red Hat Enterprise Linux 6
  • Red Hat Enterprise Linux 7
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.5
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27218
  2. 2026-10-03 Alias added: GHSA-86wm-rrjm-8wh8

References

Patch 4

Advisory 5

Other 220

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences