cve.bz

CVE-2023-40167

5.3 mediumEPSS 1.3%

Medium (5.3). EPSS 1.3% chance of exploitation in the next 30 days. Fixed in org.eclipse.jetty:jetty-http 10.0.16, 11.0.16, 12.0.1.

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.

Severity

CVSS 3.1

5.3 medium
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
EPSS
1.3% chance of exploitation in the next 30 days; higher than 70% of CVEs (scores of 2026-10-31)
CWE
CWE-130
Published
Modified
Record from
the NVD, synced

Affected

Packages (OSV)

AdvisoryEcosystemPackageAffectedFixed in
GHSA-hmr7-m48g-48f6Mavenorg.eclipse.jetty:jetty-http>=9.0.0 <9.4.529.4.52
GHSA-hmr7-m48g-48f6Mavenorg.eclipse.jetty:jetty-http>=10.0.0 <10.0.1610.0.16
GHSA-hmr7-m48g-48f6Mavenorg.eclipse.jetty:jetty-http>=11.0.0 <11.0.1611.0.16
GHSA-hmr7-m48g-48f6Mavenorg.eclipse.jetty:jetty-http>=12.0.0 <12.0.112.0.1

References

Check your stackJSON