Read the docs
TI-2023-21041 Aliases CVE-2023-40167GHSA-hmr7-m48g-48f6

Jetty accepts "+" prefixed value in Content-Length

Priority LOW 33CWE-130Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 10 fixed, 12 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.01279 70th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-http (Maven): 9.4.52, 10.0.16, 11.0.16 +1Red Hat: 10 advisoriesRed Hat: 10 fixed, 12 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse Foundationjetty.project9.0.0 – 9.4.51; 10.0.0 – 10.0.15; 11.0.0 – 11.0.15; = 12.0.0—No fix listedCNA
—org.eclipse.jetty:jetty-http (Maven)9.0.0 to before 9.4.529.4.52Patch availableGHSA-hmr7-m48g-48f6
—org.eclipse.jetty:jetty-http (Maven)10.0.0 to before 10.0.1610.0.16Patch availableGHSA-hmr7-m48g-48f6
—org.eclipse.jetty:jetty-http (Maven)11.0.0 to before 11.0.1611.0.16Patch availableGHSA-hmr7-m48g-48f6
—org.eclipse.jetty:jetty-http (Maven)12.0.0 to before 12.0.112.0.1Patch availableGHSA-hmr7-m48g-48f6
  • jetty.project VendorEclipse Foundation Affected 9.0.0 – 9.4.51; 10.0.0 – 10.0.15; 11.0.0 – 11.0.15; = 12.0.0 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 9.0.0 to before 9.4.52 Fixed in 9.4.52 Patch available GHSA-hmr7-m48g-48f6
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 10.0.0 to before 10.0.16 Fixed in 10.0.16 Patch available GHSA-hmr7-m48g-48f6
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 11.0.0 to before 11.0.16 Fixed in 11.0.16 Patch available GHSA-hmr7-m48g-48f6
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 12.0.0 to before 12.0.1 Fixed in 12.0.1 Patch available GHSA-hmr7-m48g-48f6

CPE configurations NVD · 10

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.0.0 to before 9.4.52; 10.0.0 to before 10.0.16; 11.0.0 to before 11.0.16VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.0.0:-:*:*:*:*:*:*12.0.0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.0.0:beta0:*:*:*:*:*:*12.0.0 beta0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.0.0:beta1:*:*:*:*:*:*12.0.0 beta1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.0.0:beta2:*:*:*:*:*:*12.0.0 beta2VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.0.0:beta3:*:*:*:*:*:*12.0.0 beta3VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.0.0:beta4:*:*:*:*:*:*12.0.0 beta4VulnerableEclipse Foundation
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:*12.0VulnerableDebian
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.0.0 to before 9.4.52; 10.0.0 to before 10.0.16; 11.0.0 to before 11.0.16 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.0.0:-:*:*:*:*:*:* Versions 12.0.0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.0.0:beta0:*:*:*:*:*:* Versions 12.0.0 beta0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.0.0:beta1:*:*:*:*:*:* Versions 12.0.0 beta1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.0.0:beta2:*:*:*:*:*:* Versions 12.0.0 beta2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.0.0:beta3:*:*:*:*:*:* Versions 12.0.0 beta3 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.0.0:beta4:*:*:*:*:*:* Versions 12.0.0 beta4 Vulnerable ·Eclipse Foundation
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:12.0:*:*:*:*:*:*:* Versions 12.0 Vulnerable ·Debian

Remediation

  • Fix · GHSA-hmr7-m48g-48f6 org.eclipse.jetty:jetty-http (Maven) Fixed in 9.4.52 Advisory →
  • Fix · GHSA-hmr7-m48g-48f6 org.eclipse.jetty:jetty-http (Maven) Fixed in 10.0.16 Advisory →
  • Fix · GHSA-hmr7-m48g-48f6 org.eclipse.jetty:jetty-http (Maven) Fixed in 11.0.16 Advisory →
  • Fix · GHSA-hmr7-m48g-48f6 org.eclipse.jetty:jetty-http (Maven) Fixed in 12.0.1 Advisory →

Red Hat 10 advisories

  • RHSA-2024:3354 Released 2024-05-23 · Red Hat rating Important
    Red Hat Fuse 7.13.0 release and security update
    • Red Hat Fuse 7.13.0
  • RHSA-2024:2010 Released 2024-04-23 · Red Hat rating Important
    Satellite 6.15.0 release
    • Red Hat Satellite 6.15 for RHEL 8 foreman-3.9.1.6-1.el8sat, foreman-cli-3.9.1.6-1.el8sat, foreman-debug-3.9.1.6-1.el8sat +28
  • RHSA-2024:0797 Released 2024-02-13 · Red Hat rating Important
    Satellite 6.14.2 Async Security Update
    • Red Hat Satellite 6.14 for RHEL 8 candlepin-4.3.11-1.el8sat, candlepin-selinux-4.3.11-1.el8sat, mosquitto-2.0.17-1.el8sat +5
Show 7 more Red Hat advisories
  • RHSA-2024:0778 Released 2024-02-12 · Red Hat rating Important
    Jenkins and Jenkins-2-plugins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1706515741-1.el8, jenkins-2.426.3.1706515686-3.el8
  • RHSA-2023:7697 Released 2023-12-07 · Red Hat rating Moderate
    AMQ Clients 2023.Q4
    • Red Hat AMQ Clients
  • RHSA-2023:7678 Released 2023-12-06 · Red Hat rating Important
    Red Hat AMQ Streams 2.6.0 release and security update
    • Red Hat AMQ Streams 2.6.0
  • RHSA-2023:7247 Released 2023-11-15 · Red Hat rating Critical
    Red Hat Fuse 7.12.1 release and security update
    • Red Hat Fuse 7.12.1
  • RHSA-2023:5946 Released 2023-10-19 · Red Hat rating Important
    Red Hat AMQ Broker 7.11.3 release and security update
    • Red Hat AMQ Broker 7
  • RHSA-2023:5780 Released 2023-10-17 · Red Hat rating Important
    Red Hat Integration Camel Extensions for Quarkus 2.13.3 security update
    • Red Hat Integration Camel Quarkus 2
  • RHSA-2023:5441 Released 2023-10-04 · Red Hat rating Moderate
    Red Hat Integration Camel for Spring Boot 4.0.0 release and security update
    • RHINT Camel-Springboot 4.0.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
A-MQ Clients 2AffectedNo fix yet
OpenShift ServerlessAffectedNo fix planned: Will not fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 9AffectedNo fix planned: Will not fix
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
Red Hat Single Sign-On 7AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 3AffectedNo fix yet
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2024:0778
RHINT Camel-Springboot 4.0.0Fixed RHSA-2023:5441
Red Hat AMQ Broker 7Fixed RHSA-2023:5946
Red Hat AMQ ClientsFixed RHSA-2023:7697
Red Hat AMQ Streams 2.6.0Fixed RHSA-2023:7678
Red Hat Fuse 7.12.1Fixed RHSA-2023:7247
Red Hat Fuse 7.13.0Fixed RHSA-2024:3354
Red Hat Integration Camel Quarkus 2Fixed RHSA-2023:5780
Red Hat Satellite 6.14 for RHEL 8Fixed RHSA-2024:0797
Red Hat Satellite 6.15 for RHEL 8Fixed RHSA-2024:2010
Not affected: 8 products
  • Migration Toolkit for Applications 6
  • Migration Toolkit for Runtimes
  • OpenShift Developer Tools and Services for OCP 4.12
  • Red Hat Enterprise Linux 8
  • Red Hat OpenShift Container Platform 4
  • Red Hat OpenShift Dev Spaces
  • Red Hat Satellite 6.14 for RHEL 8
  • Red Hat Satellite 6.15 for RHEL 8

Timeline

  1. 2026-10-02 Threatist record created from CVE-2023-40167
  2. 2026-10-03 Alias added: GHSA-hmr7-m48g-48f6

References

Advisory 4

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences