Iniciar sesión
Deutsch English Español Polski
Media

DOS vulnerability for Quoted Quality CSV headers

  • Publicada: 10.03.2021
  • Actualizado: 11.10.2026 12:22

Impact

When Jetty handles a request containing request headers with a large number of “quality” (i.e. q) parameters (such as what are seen on the Accept, Accept-Encoding, and Accept-Language request headers), the server may enter a denial of service (DoS) state due to high CPU usage while sorting the list of values based on their quality values. A single request can easily consume minutes of CPU time before it is even dispatched to the application.

The only features within Jetty that can trigger this behavior are:

  • Default Error Handling - the Accept request header with the QuotedQualityCSV is used to determine what kind of content to send back to the client (html, text, json, xml, etc)
  • StatisticsServlet - uses the Accept request header with the QuotedQualityCSV to determine what kind of content to send back to the client (xml, json, text, html, etc)
  • HttpServletRequest.getLocale() - uses the Accept-Language request header with the QuotedQualityCSV to determine which “preferred” language is returned on this call.
  • HttpservletRequest.getLocales() - is similar to the above, but returns an ordered list of locales based on the quality values on the Accept-Language request header.
  • DefaultServlet - uses the Accept-Encoding request header with the QuotedQualityCSV to determine which kind of pre-compressed content should be sent back for static content (content that is not matched against a url-pattern in your web app)

Versions

QuotedQualityCSV was introduced to Jetty 9.3.9.v20160517 and the bug that introduced the vulnerability was in 9.4.6.v20170531.

Currently, known vulnerable versions include:

  • 9.4.6.v20170531 thru to 9.4.36.v20210114
  • 10.0.0
  • 11.0.0

Workarounds

Quality ordered values are used infrequently by jetty so they can be avoided by:

  • Do not use the default error page/handler.
  • Do not deploy the StatisticsServlet exposed to the network
  • Do not call getLocale API
  • Do not enable precompressed static content in the DefaultServlet

Patches

All patches are available for download from the Eclipse Jetty website at https://www.eclipse.org/jetty/download.php

  • 9.4.37.v20210219 and greater
  • 10.0.1 and greater
  • 11.0.1 and greater

Software afectado

Haz clic en una tecnología para ver todas sus vulnerabilidades.

PlataformaPaqueteVersiones vulnerablesCorregida en
Java / Kotlin (Maven) org.eclipse.jetty:jetty-server >= 9.4.6, < 9.4.37, >= 10.0.0, < 10.0.1, >= 11.0.0, < 11.0.1 9.4.37, 10.0.1, 11.0.1

Referencias

Puntuación CVSS 5.3/10
Vector CVSS
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Debilidad (CWE)
CWE-400
Plataforma
Java / Kotlin (Maven)
Paquete
org.eclipse.jetty:jetty-server
Publicada
10.03.2021
Actualizado
11.10.2026 12:22

Fuentes y licencias

OSV / GitHub Advisory Database - GHSA-m394-8rww-3jr7 - CC BY 4.0

Historial de vulnerabilidades: org.eclipse.jetty:jetty-server

Todas las vulnerabilidades publicadas de este paquete (Java / Kotlin (Maven)), de la más reciente a la más antigua. Muestra si es un fallo aislado o un paquete que hay que vigilar.

Todas (29) en el archivo
Entradas en total
29
Primera → última
10.2018 07.2026
Sin corrección
0
Explotada en ataques
0

Distribución por gravedad

  • Crítica 4
  • Alta 10
  • Media 13
  • Baja 2

Divulgaciones por año

Gravedad:
  1. Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
    Alta · 7.5 CVE-2024-7708 >= 10.0.7, < 10.0.23, >= 11.0.7, < 11.0.23 10.0.23, 11.0.23
  2. The Eclipse Jetty Server Artifact has a Gzip request memory leak
    Alta · 7.5 CVE-2026-1605 >= 12.1.0, < 12.1.6, >= 12.0.0, < 12.0.32 12.1.6, 12.0.32
  3. **UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request
    Alta · 7.2 CVE-2024-13009 >= 9.4.0, < 9.4.57.v20241219 9.4.57.v20241219
  4. Jetty SslConnection does not release pooled ByteBuffers in case of errors
    Alta · 7.5 CVE-2022-2191 >= 10.0.0, < 10.0.10, >= 11.0.0, < 11.0.10 10.0.10, 11.0.10
  5. Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
    Alta · 7.5 CVE-2021-28165 >= 7.2.2, < 9.4.39, >= 10.0.0, < 10.0.2, >= 11.0.0, < 11.0.2 9.4.39, 10.0.2, 11.0.2
  6. DOS vulnerability for Quoted Quality CSV headers esta entrada
    Media · 5.3 CVE-2020-27223 >= 9.4.6, < 9.4.37, >= 10.0.0, < 10.0.1, >= 11.0.0, < 11.0.1 9.4.37, 10.0.1, 11.0.1
  7. Operation on a Resource after Expiration or Release in Jetty Server
    Crítica · 9.4 CVE-2019-17638 >= 9.4.27, < 9.4.30.v20200611 9.4.30.v20200611
  8. Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server
    Alta · 7.5 CVE-2018-12545 >= 9.4.0, < 9.4.12.v20180830, >= 9.3.0, < 9.3.25.v20180904 9.4.12.v20180830, 9.3.25.v20180904
  9. Jetty vulnerable to exposure of sensitive information to unauthenticated remote users
    Alta · 7.5 CVE-2015-2080 < 9.2.9.v20150224 9.2.9.v20150224
  10. Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)
    Crítica · 9.8 CVE-2017-7658 < 9.2.25.v20180606, >= 9.3.0, < 9.3.24.v20180605, >= 9.4.0, < 9.4.11.v20180605 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605
  11. Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)
    Alta · 7.5 CVE-2017-7656 < 9.3.24.v20180605, >= 9.4.0, < 9.4.11.v20180605 9.3.24.v20180605, 9.4.11.v20180605
  12. Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
    Crítica · 9.8 CVE-2016-4800 >= 9.3.0, < 9.3.9 9.3.9
  13. Jetty vulnerable to exposure of sensitive information due to observable discrepancy
    Alta · 7.5 CVE-2017-9735 >= 9.4.0, < 9.4.6.v20170531, >= 9.3.0, < 9.3.20.v20170531, < 9.2.22.v20170606 9.4.6.v20170531, 9.3.20.v20170531, 9.2.22.v20170606
  14. Critical severity vulnerability that affects org.eclipse.jetty:jetty-server
    Crítica · 9.8 CVE-2017-7657 < 9.2.25.v20180606, >= 9.3.0, < 9.3.24.v20180605 9.2.25.v20180606, 9.3.24.v20180605
  15. Access and integrity issue within Eclipse Jetty
    Alta · 8.8 CVE-2018-12538 >= 9.4.0, < 9.4.11.v20180605 9.4.11.v20180605

Identifica las vulnerabilidades de tu aplicación

Con la integración de DockRay y el inventario de software activado, DockRay compara las versiones notificadas de los componentes con las vulnerabilidades conocidas y avisa de las coincidencias confirmadas. La cobertura depende de la tecnología compatible y de los avisos disponibles.

Conectar tu aplicación
Newsletter DockRay

La seguridad de tus aplicaciones en tu correo

Vulnerabilidades importantes, recomendaciones concretas y consejos prácticos para tus aplicaciones. Elige tus tecnologías y sigue lo que importa para tu proyecto.

  • Un resumen diario de nuevas vulnerabilidades, también las críticas.
  • Avisos sobre actualizaciones importantes.
  • Consejos prácticos sobre seguridad y monitorización de aplicaciones.

Déjalo vacío para recibir avisos de todas las tecnologías.

Política de privacidad

Suscripción gratuita. Date de baja con un clic en cualquier correo.