CVE-2020-27223

5.3 mediumEPSS 78%

Medium (5.3). EPSS 78% chance of exploitation in the next 30 days. Fixed in org.eclipse.jetty:jetty-server 10.0.1, 11.0.1, 9.4.37.

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Severity

CVSS 3.1

5.3 medium

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

EPSS: 78% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWEs: CWE-400, CWE-407
Published: 2021-02-26
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

apache:nifi
apache:solr
apache:spark
debian:debian_linux
eclipse:jetty
netapp:e-series_santricity_os_controller
netapp:e-series_santricity_web_services
netapp:element_plug-in_for_vcenter_server
netapp:hci
netapp:hci_management_node
netapp:management_services_for_element_software
netapp:snap_creator_framework
netapp:snapcenter
netapp:snapmanager
netapp:solidfire
oracle:rest_data_services

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-m394-8rww-3jr7	Maven	org.eclipse.jetty:jetty-server	>=9.4.6 <9.4.37	9.4.37
GHSA-m394-8rww-3jr7	Maven	org.eclipse.jetty:jetty-server	>=10.0.0 <10.0.1	10.0.1
GHSA-m394-8rww-3jr7	Maven	org.eclipse.jetty:jetty-server	>=11.0.0 <11.0.1	11.0.1

References

Check your stack JSON