jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

🗓️ 09 Sep 2022 07:12:07Reported by RedHatType

Jetty may DoS on requests with many Accept headers and numerous quality values, causing high CPU usage.

Reporter	Title	Published	Views	Family All 87
IBM Security Bulletins	Security Bulletin: IBM Cognos Command Center is affected by multiple vulnerabilities	4 May 202320:23	–	ibm
IBM Security Bulletins	Security Bulletin: CVE-2020-27223 when Jetty handles a request containing multiple Accept headers the server may enter a denial of service (DoS) state	30 Jul 202105:03	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of jetty IBM webMethods BPM is vulnerable to multiple vulnerabilities	11 Mar 202620:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect the IBM App Connect Enterprise Toolkit and the IBM Integration Bus Toolkit	30 Jun 202309:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Analytics has addressed multiple vulnerabilities	29 Jun 202123:59	–	ibm
IBM Security Bulletins	Security Bulletin: Common vulnerabilities fixed in Cloudera Data Platform 7.1.9 HF2	7 May 202419:54	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Eclipse Jetty affects IBM Process Mining (CVE-2020-27223,CVE-2021-28169)	1 Feb 202321:57	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Security SOAR is using a component with known vulnerabilities - Eclipse Jetty ( CVE-2021-28163, CVE-2021-28165, CVE-2020-27223)	14 Jul 202118:24	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities were detected in IBM Secure Proxy	30 Jul 202105:06	–	ibm
IBM Security Bulletins	Security Bulletin: Security fixes available for The IBM® Engineering System Design Rhapsody products on IBM Jazz Technology	19 Apr 202407:11	–	ibm

Vulners

Node

AND

redhat integrationRange<1

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2020-27223
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7
nvd	www.nvd.nist.gov/vuln/detail/CVE-2020-27223
cve	www.cve.org/CVERecord

28 Jun 2026 12:37Current

7.2High risk

Vulners AI Score7.2

CVSS 24.3

CVSS 3.15.2 - 5.3

EPSS0.7795

CWE-400