Vulnerability in Eclipse Jetty
CVE-2019-17638
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is relea…
EPSS: 0.111 (95.5th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 9.4 (Critical). Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L.
Affected products
- Eclipse Jetty — versions 9.4.27, 9.4.28, 9.4.29
- The Eclipse Foundation Jetty — versions 9.4.27.v20200227 to 9.4.29.v20200521
Weakness classification (CWE)
Public proof-of-concept exploits
References
- emo@eclipse.org (x_refsource_CONFIRM, Vendor Advisory)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (x_refsource_FEDORA, vendor-advisory)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
- emo@eclipse.org (mailing-list, x_refsource_MLIST)
Frequently asked questions
- What is CVE-2019-17638?
- CVE-2019-17638 is a critical-severity vulnerability in Eclipse Jetty, classified under Operation on a Resource after Expiration or Release. CVSS score: 9.4/10. Published 2020-07-09.
- How severe is CVE-2019-17638?
- Critical severity. CVSS v3 base score is 9.4 out of 10.
- Is CVE-2019-17638 known to be exploited?
- 5 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.