The Eclipse Foundation Eclipse Jetty

CVE-2020-27223

MEDIUM 5.2

At a glance

Source: NVD
EPSS: EPSS 78.03 % · percentile 100 (2026-10-29)
State: PUBLISHED
Published: 2021-02-26 21:55 UTC
Updated: 2025-08-20 10:03 UTC
Assigner: eclipse
NVD status: Modified

Search on…

Description

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Weaknesses (CWE)

CWE-407 — Inefficient Algorithmic Complexity
CWE-400 — Uncontrolled Resource Consumption

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	MEDIUM 5.2	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H	eclipse
CVSS 3.1	MEDIUM 5.2	CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H	NVD · emo@eclipse.org (Secondary)
CVSS 3.1	MEDIUM 5.3	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L	NVD · nvd@nist.gov (Primary)
CVSS 2.0	MEDIUM 4.3	AV:N/AC:M/Au:N/C:N/I:N/A:P	NVD · nvd@nist.gov (Primary)

Advisories

GHSA-m394-8rww-3jr7 — DOS vulnerability for Quoted Quality CSV headers

European references

ENISA EUVD · EUVD-2021-0679
GCVE · GCVE-0-2020-27223

CERT-FR advisories

CERTFR-2023-AVI-0357 — Multiples vulnérabilités dans IBM Cognos · cert.ssi.gouv.fr
CERTFR-2021-AVI-951 — Multiples vulnérabilités dans le noyau Linux de RedHat · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 9.4.7 < 9.4.36
cpe:2.3:a:eclipse:jetty:9.4.6:20170531:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.4.6:20180619:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.4.36:-:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:9.4.36:20210114:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:10.0.0:-:*:*:*:*:*:*
cpe:2.3:a:eclipse:jetty:11.0.0:-:*:*:*:*:*:*
cpe:2.3:a:apache:nifi:1.13.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:spark:3.1.1:-:*:*:*:*:*:*
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* ≥ 11.0.0 ≤ 11.70.1
cpe:2.3:a:netapp:e-series_santricity_web_services:-:*:*:*:*:web_services_proxy:*:*
cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:hci_management_node:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:oracle:*:*
cpe:2.3:a:netapp:snapmanager:-:*:*:*:*:sap:*:*
cpe:2.3:a:netapp:solidfire:-:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
cpe:2.3:a:apache:solr:8.8.1:*:*:*:*:*:*:*
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:* < 20.4.3.050.1904

Affected products

Product	Versions
The Eclipse Foundation · Eclipse Jetty	affected 9.4.6.v20170531 < unspecified ; affected unspecified ≤ 9.4.36.v20210114 ; affected 10.0.0 ; affected 11.0.0

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD

🟡 The Eclipse Foundation Eclipse Jetty