Read the docs
TI-2020-16549 Aliases CVE-2020-27223GHSA-m394-8rww-3jr7

Uncontrolled resource consumption in Eclipse Jetty

Priority MEDIUM 64CWE-407Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 10 fixed, 8 without a fix

Attack profile from CVSS 3.1 · NVD. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-407.

Summary

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Why it matters now

EPSS 0.78031 99th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-server (Maven): 9.4.37, 10.0.1, 11.0.1Red Hat: 8 advisoriesRed Hat: 10 fixed, 8 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty9.4.6.v20170531 and later; up to 9.4.36.v20210114; 10.0.0; 11.0.0—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)9.4.6 to before 9.4.379.4.37Patch availableGHSA-m394-8rww-3jr7
—org.eclipse.jetty:jetty-server (Maven)10.0.0 to before 10.0.110.0.1Patch availableGHSA-m394-8rww-3jr7
—org.eclipse.jetty:jetty-server (Maven)11.0.0 to before 11.0.111.0.1Patch availableGHSA-m394-8rww-3jr7
  • Eclipse Jetty VendorEclipse Foundation Affected 9.4.6.v20170531 and later; up to 9.4.36.v20210114; 10.0.0; 11.0.0 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 9.4.6 to before 9.4.37 Fixed in 9.4.37 Patch available GHSA-m394-8rww-3jr7
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 10.0.0 to before 10.0.1 Fixed in 10.0.1 Patch available GHSA-m394-8rww-3jr7
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 11.0.0 to before 11.0.1 Fixed in 11.0.1 Patch available GHSA-m394-8rww-3jr7

CPE configurations NVD · 23

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.4.7 to before 9.4.36VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.6:20170531:*:*:*:*:*:*9.4.6 20170531VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.6:20180619:*:*:*:*:*:*9.4.6 20180619VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.36:-:*:*:*:*:*:*9.4.36VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:9.4.36:20210114:*:*:*:*:*:*9.4.36 20210114VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:10.0.0:-:*:*:*:*:*:*10.0.0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:11.0.0:-:*:*:*:*:*:*11.0.0VulnerableEclipse Foundation
cpe:2.3:a:apache:nifi:1.13.0:*:*:*:*:*:*:*1.13.0VulnerableApache
cpe:2.3:a:apache:spark:3.1.1:-:*:*:*:*:*:*3.1.1VulnerableApache
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*11.0.0 – 11.70.1VulnerableNetApp
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.4.7 to before 9.4.36 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.6:20170531:*:*:*:*:*:* Versions 9.4.6 20170531 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.6:20180619:*:*:*:*:*:* Versions 9.4.6 20180619 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.36:-:*:*:*:*:*:* Versions 9.4.36 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:9.4.36:20210114:*:*:*:*:*:* Versions 9.4.36 20210114 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:10.0.0:-:*:*:*:*:*:* Versions 10.0.0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:11.0.0:-:*:*:*:*:*:* Versions 11.0.0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:apache:nifi:1.13.0:*:*:*:*:*:*:* Versions 1.13.0 Vulnerable ·Apache
  • cpe:2.3:a:apache:spark:3.1.1:-:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Apache
  • cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0.0 – 11.70.1 Vulnerable ·NetApp
Show 13 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:a:apache:solr:8.8.1:*:*:*:*:*:*:*8.8.1VulnerableApache
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*before 20.4.3.050.1904VulnerableOracle
  • cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:a:apache:solr:8.8.1:*:*:*:*:*:*:* Versions 8.8.1 Vulnerable ·Apache
  • cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* Versions before 20.4.3.050.1904 Vulnerable ·Oracle

Remediation

  • Fix · GHSA-m394-8rww-3jr7 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.37 Advisory →
  • Fix · GHSA-m394-8rww-3jr7 org.eclipse.jetty:jetty-server (Maven) Fixed in 10.0.1 Advisory →
  • Fix · GHSA-m394-8rww-3jr7 org.eclipse.jetty:jetty-server (Maven) Fixed in 11.0.1 Advisory →

Red Hat 8 advisories

  • RHSA-2022:6407 Released 2022-09-09 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.8 security update
    • RHAF Camel-K 1.8
  • RHSA-2021:5134 Released 2021-12-14 · Red Hat rating Critical
    Red Hat Fuse 7.10.0 release and security update
    • Red Hat Fuse 7.10
  • RHSA-2021:4767 Released 2021-11-23 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus GA security update
    • Red Hat Integration Camel Quarkus 2
Show 5 more Red Hat advisories
  • RHSA-2021:3700 Released 2021-09-30 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.9.0 release and security update
    • Red Hat AMQ 7.9.0
  • RHSA-2021:2689 Released 2021-07-12 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.8.2 release and security update
    • Red Hat AMQ 7.8.2
  • RHSA-2021:2431 Released 2021-07-02 · Red Hat rating Important
    OpenShift Container Platform 4.5.41 security update
    • Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins-4.5.1623326336-1.el7, jenkins-2.277.3.1623846768-1.el7
  • RHSA-2021:2517 Released 2021-06-30 · Red Hat rating Important
    OpenShift Container Platform 3.11.462 bug fix and security update
    • Red Hat OpenShift Container Platform 3.11 jenkins-2-plugins-3.11.1624366838-1.el7, jenkins-2.289.1.1624365627-1.el7
  • RHSA-2021:2499 Released 2021-06-29 · Red Hat rating Moderate
    OpenShift Container Platform 4.6.36 security update
    • Red Hat OpenShift Container Platform 4.6 jenkins-2.277.3.1623853726-1.el8

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 6AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
7Server-RHMTC-1.4Fixed—
8Base-RHMTC-1.4Fixed—
RHAF Camel-K 1.8Fixed RHSA-2022:6407
Red Hat AMQ 7.8.2Fixed RHSA-2021:2689
Red Hat AMQ 7.9.0Fixed RHSA-2021:3700
Red Hat Fuse 7.10Fixed RHSA-2021:5134
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:4767
Red Hat OpenShift Container Platform 3.11Fixed RHSA-2021:2517
Red Hat OpenShift Container Platform 4.5Fixed RHSA-2021:2431
Red Hat OpenShift Container Platform 4.6Fixed RHSA-2021:2499
Not affected: 6 products
  • Red Hat Decision Manager 7
  • Red Hat OpenShift Container Platform 3.11
  • Red Hat OpenShift Container Platform 4.5
  • Red Hat OpenShift Container Platform 4.6
  • Red Hat Process Automation 7
  • Red Hat Single Sign-On 7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2020-27223
  2. 2026-10-03 Alias added: GHSA-m394-8rww-3jr7

References

Patch 2

Advisory 5

Other 123

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences