Read the docs
TI-2023-18319 Aliases CVE-2023-36478GHSA-wgh7-54f2-x98r

HTTP/2 HPACK integer overflow and buffer allocation

Priority MEDIUM 41CWE-190Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 2 fixed, 7 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-190 and the CVSS impact.

Summary

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

Why it matters now

EPSS 0.04832 92nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial jetty.project (eclipse): 10.0.16, 11.0.16, 9.4.53org.eclipse.jetty.http2:http2-hpack (Maven): 10.0.16, 11.0.16, 9.4.53+1 more productRed Hat: 2 advisoriesRed Hat: 2 fixed, 7 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse Foundationjetty.project10.0.0 to before 10.0.16; 11.0.0 to before 11.0.16; 9.3.0 to before 9.4.5310.0.16, 11.0.16, 9.4.53Patch availableCNA
—org.eclipse.jetty.http2:http2-hpack (Maven)10.0.0 to before 10.0.1610.0.16Patch availableGHSA-wgh7-54f2-x98r
—org.eclipse.jetty.http2:http2-hpack (Maven)11.0.0 to before 11.0.1611.0.16Patch availableGHSA-wgh7-54f2-x98r
—org.eclipse.jetty.http3:http3-qpack (Maven)10.0.0 to before 10.0.1610.0.16Patch availableGHSA-wgh7-54f2-x98r
—org.eclipse.jetty.http3:http3-qpack (Maven)11.0.0 to before 11.0.1611.0.16Patch availableGHSA-wgh7-54f2-x98r
—org.eclipse.jetty.http2:http2-hpack (Maven)9.3.0 to before 9.4.539.4.53Patch availableGHSA-wgh7-54f2-x98r
  • jetty.project VendorEclipse Foundation Affected 10.0.0 to before 10.0.16; 11.0.0 to before 11.0.16; 9.3.0 to before 9.4.53 Fixed in 10.0.16, 11.0.16, 9.4.53 Patch available CNA
  • org.eclipse.jetty.http2:http2-hpack (Maven) Vendor— Affected 10.0.0 to before 10.0.16 Fixed in 10.0.16 Patch available GHSA-wgh7-54f2-x98r
  • org.eclipse.jetty.http2:http2-hpack (Maven) Vendor— Affected 11.0.0 to before 11.0.16 Fixed in 11.0.16 Patch available GHSA-wgh7-54f2-x98r
  • org.eclipse.jetty.http3:http3-qpack (Maven) Vendor— Affected 10.0.0 to before 10.0.16 Fixed in 10.0.16 Patch available GHSA-wgh7-54f2-x98r
  • org.eclipse.jetty.http3:http3-qpack (Maven) Vendor— Affected 11.0.0 to before 11.0.16 Fixed in 11.0.16 Patch available GHSA-wgh7-54f2-x98r
  • org.eclipse.jetty.http2:http2-hpack (Maven) Vendor— Affected 9.3.0 to before 9.4.53 Fixed in 9.4.53 Patch available GHSA-wgh7-54f2-x98r

CPE configurations NVD · 6

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.3.0 to before 9.4.53; 10.0.0 to before 10.0.16; 11.0.0 to before 11.0.16VulnerableEclipse Foundation
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*before 2.414.3VulnerableJenkins
cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:*before 2.428VulnerableJenkins
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*12.0VulnerableDebian
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.3.0 to before 9.4.53; 10.0.0 to before 10.0.16; 11.0.0 to before 11.0.16 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions before 2.414.3 Vulnerable ·Jenkins
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:-:*:*:* Versions before 2.428 Vulnerable ·Jenkins
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian

Remediation

  • Fix · CNA jetty.project (eclipse) Fixed in 10.0.16, 11.0.16, 9.4.53
  • Fix · GHSA-wgh7-54f2-x98r org.eclipse.jetty.http2:http2-hpack (Maven) Fixed in 10.0.16 Advisory →
  • Fix · GHSA-wgh7-54f2-x98r org.eclipse.jetty.http2:http2-hpack (Maven) Fixed in 11.0.16 Advisory →
  • Fix · GHSA-wgh7-54f2-x98r org.eclipse.jetty.http3:http3-qpack (Maven) Fixed in 10.0.16 Advisory →
  • Fix · GHSA-wgh7-54f2-x98r org.eclipse.jetty.http3:http3-qpack (Maven) Fixed in 11.0.16 Advisory →
  • Fix · GHSA-wgh7-54f2-x98r org.eclipse.jetty.http2:http2-hpack (Maven) Fixed in 9.4.53 Advisory →

Red Hat 2 advisories

  • RHSA-2024:3354 Released 2024-05-23 · Red Hat rating Important
    Red Hat Fuse 7.13.0 release and security update
    • Red Hat Fuse 7.13.0
  • RHSA-2023:7247 Released 2023-11-15 · Red Hat rating Critical
    Red Hat Fuse 7.12.1 release and security update
    • Red Hat Fuse 7.12.1

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Integration Camel Quarkus 2AffectedNo fix planned: Will not fix
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix yet
Red Hat Satellite 6AffectedNo fix yet
Red Hat Fuse 7.12.1Fixed RHSA-2023:7247
Red Hat Fuse 7.13.0Fixed RHSA-2024:3354
Not affected: 3 products
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-36478
  2. 2026-10-03 Alias added: GHSA-wgh7-54f2-x98r
  3. 2026-10-11 EPSS moved to the 90th–95th percentile
  4. 2026-10-11 Priority changed: LOW → MEDIUM

References

Exploit 1

Patch 1

Advisory 4

Other 9

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences