{"cve":"CVE-2017-7658","nvd":{"published":"2018-06-26T17:29:00.210","modified":"2026-06-17T01:24:54.410","status":"Modified","description":"In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.","cvss_v4":null,"cvss_v3":{"version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","score":9.8},"cwes":["CWE-444"],"references":["http://www.securityfocus.com/bid/106566","http://www.securitytracker.com/id/1041194","https://bugs.eclipse.org/bugs/show_bug.cgi?id=535669","https://lists.apache.org/thread.html/053d9ce4d579b02203db18545fee5e33f35f2932885459b74d1e4272%40%3Cissues.activemq.apache.org%3E","https://lists.apache.org/thread.html/708d94141126eac03011144a971a6411fcac16d9c248d1d535a39451%40%3Csolr-user.lucene.apache.org%3E"],"products":["debian:debian_linux","eclipse:jetty","hp:xp_p9000_command_view","netapp:e-series_santricity_management","netapp:e-series_santricity_os_controller","netapp:e-series_santricity_web_services","netapp:hci_management_node","netapp:hci_storage_node","netapp:oncommand_system_manager","netapp:oncommand_unified_manager_for_7-mode","netapp:santricity_cloud_connector","netapp:snap_creator_framework","netapp:snapcenter","netapp:snapmanager","netapp:solidfire","netapp:storage_services_connector","oracle:rest_data_services","oracle:retail_xstore_payment","oracle:retail_xstore_point_of_service"],"source":"nvd","synced_at":"2026-10-19T20:51:47.459859389+00:00"},"epss":{"cve":"CVE-2017-7658","score":0.19362,"percentile":0.97354,"date":"2026-10-31"},"kev":null,"osv":[{"id":"GHSA-6x9x-8qw9-9pp6","url":"https://osv.dev/vulnerability/GHSA-6x9x-8qw9-9pp6","summary":"Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)","modified":"2024-02-16T08:16:22.832624Z","packages":[{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server","ranges":["<9.2.25.v20180606"],"fixed":["9.2.25.v20180606"]},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server","ranges":[">=9.3.0 <9.3.24.v20180605"],"fixed":["9.3.24.v20180605"]},{"ecosystem":"Maven","name":"org.eclipse.jetty:jetty-server","purl":"pkg:maven/org.eclipse.jetty/jetty-server","ranges":[">=9.4.0 <9.4.11.v20180605"],"fixed":["9.4.11.v20180605"]}]}],"attribution":["This product uses the NVD API but is not endorsed or certified by the NVD.","EPSS scores: FIRST Exploit Prediction Scoring System, https://www.first.org/epss","Known exploited vulnerabilities: CISA Known Exploited Vulnerabilities Catalog, https://www.cisa.gov/known-exploited-vulnerabilities-catalog","Package advisories: OSV (https://osv.dev), from the GitHub Advisory Database, PyPA, Go, RustSec and other ecosystem databases, under CC-BY 4.0 or CC0","CVE records: the CVE Program's CVE List (https://www.cve.org), under its terms of use (https://www.cve.org/Legal/TermsOfUse). CVE is a registered trademark of The MITRE Corporation; this product is not affiliated with the CVE Program."]}