Vulnerability in Eclipse Jetty

CVE-2017-7658

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

Vulnerability class: HTTP Request Smuggling

EPSS: 0.194 (97.2th percentile) — read the EPSS interpretation.

CVSS v3 metric

CVSS v3 base score 9.8 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.

Affected products

Weakness classification (CWE)

Public proof-of-concept exploits

References

Frequently asked questions

What is CVE-2017-7658?
CVE-2017-7658 is a critical-severity vulnerability in Eclipse Jetty, classified under Inconsistent Interpretation of HTTP Requests (HTTP Request/Response Smuggling). CVSS score: 9.8/10. Published 2018-06-26.
How severe is CVE-2017-7658?
Critical severity. CVSS v3 base score is 9.8 out of 10.
Is CVE-2017-7658 known to be exploited?
5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.