Read the docs
TI-2023-11282 Aliases CVE-2023-26048GHSA-qw69-rqj8-6qw8

OutOfMemoryError for large multipart without filename in Eclipse Jetty

Priority LOW 36CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · Low
Fix status
Partial Red Hat: 12 fixed, 16 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03369 88th percentileScored 2026-11-07
Fix Partial jetty.project (eclipse): 9.4.51, 10.0.14, 11.0.14org.eclipse.jetty:jetty-server (Maven): 9.4.51.v20230217, 10.0.14, 11.0.14Red Hat: 11 advisoriesRed Hat: 12 fixed, 16 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse Foundationjetty.projectbefore 9.4.51; 10.0.0 to before 10.0.14; 11.0.0 to before 11.0.149.4.51, 10.0.14, 11.0.14Patch availableCNA
—org.eclipse.jetty:jetty-server (Maven)before 9.4.51.v202302179.4.51.v20230217Patch availableGHSA-qw69-rqj8-6qw8
—org.eclipse.jetty:jetty-server (Maven)10.0.0 to before 10.0.1410.0.14Patch availableGHSA-qw69-rqj8-6qw8
—org.eclipse.jetty:jetty-server (Maven)11.0.0 to before 11.0.1411.0.14Patch availableGHSA-qw69-rqj8-6qw8
  • jetty.project VendorEclipse Foundation Affected before 9.4.51; 10.0.0 to before 10.0.14; 11.0.0 to before 11.0.14 Fixed in 9.4.51, 10.0.14, 11.0.14 Patch available CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected before 9.4.51.v20230217 Fixed in 9.4.51.v20230217 Patch available GHSA-qw69-rqj8-6qw8
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 10.0.0 to before 10.0.14 Fixed in 10.0.14 Patch available GHSA-qw69-rqj8-6qw8
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 11.0.0 to before 11.0.14 Fixed in 11.0.14 Patch available GHSA-qw69-rqj8-6qw8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*before 9.4.51; 10.0.0 to before 10.0.14; 11.0.0 to before 11.0.14VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions before 9.4.51; 10.0.0 to before 10.0.14; 11.0.0 to before 11.0.14 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · CNA jetty.project (eclipse) Fixed in 9.4.51, 10.0.14, 11.0.14
  • Fix · GHSA-qw69-rqj8-6qw8 org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.51.v20230217 Advisory →
  • Fix · GHSA-qw69-rqj8-6qw8 org.eclipse.jetty:jetty-server (Maven) Fixed in 10.0.14 Advisory →
  • Fix · GHSA-qw69-rqj8-6qw8 org.eclipse.jetty:jetty-server (Maven) Fixed in 11.0.14 Advisory →

Red Hat 11 advisories

  • RHSA-2024:0804 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 security update
    • Red Hat Single Sign-On 7
  • RHSA-2024:0798 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 security update on RHEL 7
    • Red Hat Single Sign-On 7.6 for RHEL 7 Server rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el7sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el7sso
  • RHSA-2024:0800 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 security update on RHEL 9
    • Red Hat Single Sign-On 7.6 for RHEL 9 rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el9sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el9sso
Show 8 more Red Hat advisories
  • RHSA-2024:0799 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 security update on RHEL 8
    • Red Hat Single Sign-On 7.6 for RHEL 8 rh-sso7-keycloak-18.0.12-1.redhat_00001.1.el8sso, rh-sso7-keycloak-server-18.0.12-1.redhat_00001.1.el8sso
  • RHSA-2024:0801 Released 2024-02-13 · Red Hat rating Important
    Red Hat Single Sign-On 7.6.7 for OpenShift image enhancement update
    • Middleware Containers for OpenShift rh-sso-7/sso76-openshift-rhel8
  • RHSA-2024:0778 Released 2024-02-12 · Red Hat rating Important
    Jenkins and Jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
  • RHSA-2023:7638 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 8 security update
    • Red Hat JBoss EAP 7.4 for RHEL 8 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el8eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el8eap +47
  • RHSA-2023:7637 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 7 security update
    • Red Hat JBoss EAP 7.4 for RHEL 7 Server eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el7eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el7eap +47
  • RHSA-2023:7639 Released 2023-12-04 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 7.4.14 on RHEL 9 security update
    • Red Hat JBoss EAP 7.4 for RHEL 9 eap7-activemq-artemis-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-cli-2.16.0-17.redhat_00051.1.el9eap, eap7-activemq-artemis-commons-2.16.0-17.redhat_00051.1.el9eap +47
  • RHSA-2023:5441 Released 2023-10-04 · Red Hat rating Moderate
    Red Hat Integration Camel for Spring Boot 4.0.0 release and security update
    • RHINT Camel-Springboot 4.0.0
  • RHSA-2023:5165 Released 2023-09-14 · Red Hat rating Important
    Red Hat AMQ Streams 2.5.0 release and security update
    • Red Hat AMQ Streams 2.5.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix yet
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat Fuse 7AffectedNo fix planned: Out of support scope
Red Hat Integration Camel K 1AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 2AffectedNo fix planned: Will not fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Satellite 6AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 3AffectedNo fix yet
streams for Apache KafkaAffectedNo fix yet
Middleware Containers for OpenShiftFixed RHSA-2024:0801
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2024:0778
RHINT Camel-Springboot 4.0.0Fixed RHSA-2023:5441
Red Hat AMQ Streams 2.5.0Fixed RHSA-2023:5165
Red Hat JBoss EAP 7.4 for RHEL 7 ServerFixed RHSA-2023:7637
Red Hat JBoss EAP 7.4 for RHEL 8Fixed RHSA-2023:7638
Red Hat JBoss EAP 7.4 for RHEL 9Fixed RHSA-2023:7639
Red Hat JBoss Enterprise Application Platform Expansion PackFixed RHSA-2024:3385
Red Hat Single Sign-On 7Fixed RHSA-2024:0804
Red Hat Single Sign-On 7.6 for RHEL 7 ServerFixed RHSA-2024:0798
Red Hat Single Sign-On 7.6 for RHEL 8Fixed RHSA-2024:0799
Red Hat Single Sign-On 7.6 for RHEL 9Fixed RHSA-2024:0800
Not affected: 12 products
  • A-MQ Clients 2
  • Migration Toolkit for Applications 6
  • Migration Toolkit for Runtimes
  • OpenShift Developer Tools and Services for OCP 4.12
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat OpenShift Application Runtimes
  • Red Hat OpenShift Container Platform 4
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-26048
  2. 2026-10-03 Alias added: GHSA-qw69-rqj8-6qw8

References

Patch 3

Advisory 2

Other 7

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences