CVE-2017-7658

9.8 criticalEPSS 19%

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Severity

CVSS 3.1

9.8 critical

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS: 19% chance of exploitation in the next 30 days; higher than 97% of CVEs (scores of 2026-10-31)
CWE: CWE-444
Published: 2018-06-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

debian:debian_linux
eclipse:jetty
hp:xp_p9000_command_view
netapp:e-series_santricity_management
netapp:e-series_santricity_os_controller
netapp:e-series_santricity_web_services
netapp:hci_management_node
netapp:hci_storage_node
netapp:oncommand_system_manager
netapp:oncommand_unified_manager_for_7-mode
netapp:santricity_cloud_connector
netapp:snap_creator_framework
netapp:snapcenter
netapp:snapmanager
netapp:solidfire
netapp:storage_services_connector
oracle:rest_data_services
oracle:retail_xstore_payment
oracle:retail_xstore_point_of_service

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-6x9x-8qw9-9pp6	Maven	org.eclipse.jetty:jetty-server	<9.2.25.v20180606	9.2.25.v20180606
GHSA-6x9x-8qw9-9pp6	Maven	org.eclipse.jetty:jetty-server	>=9.3.0 <9.3.24.v20180605	9.3.24.v20180605
GHSA-6x9x-8qw9-9pp6	Maven	org.eclipse.jetty:jetty-server	>=9.4.0 <9.4.11.v20180605	9.4.11.v20180605

References

Check your stack JSON