jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()

A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable...

Eclipse Jetty DoS

The vulnerability of the HttpServletRequest.getParameter and HttpServletRequest.getParts methods in the Eclipse Jetty server container is related to the allocation of unlimited memory. Exploiting this vulnerability could allow a remote attacker to cause a service failure...

GHSA-HMR7-M48G-48F6 Jetty accepts "+" prefixed value in Content-Length

Impact Jetty accepts the '+' character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smugglin...

jetty-server: Cookie parsing of quoted values can exfiltrate values from other cookies

A flaw was found in the jetty-server package. Nonstandard cookie parsing in Jetty may allow an attacker to smuggle cookies within other cookies or otherwise perform unintended behavior by tampering with the cookie parsing mechanism...

jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()

A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable...

Security Bulletin: Vulnerability in jetty-server affects IBM Cloud Pak for Data System 1.0(CPDS 1.0)[CVE-2023-26048]

Summary The jetty-server-9.4.48.v20220622.jar package is used by IBM Cloud Pak for Data System 1.0. IBM Cloud Pak for Data System 1.0 has addressed the applicable CVE CVE-2023-26048. Vulnerability Details CVEID:CVE-2023-26048 DESCRIPTION: Eclipse Jetty is vulnerable to a denial of service, caused...

Information Disclosure

jetty-server is vulnerable to Information Disclosure. The vulnerability exists because the cookie parsing of quoted values can exfiltrate values from other cookies because the cookie VALUE that starts with " double quote will continue to read the cookie string until it sees a closing quote even i...

SUSE CVE-2023-26048

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support e.g. annotated with @MultipartConfig that call HttpServletRequest.getParameter or HttpServletRequest.getParts may cause OutOfMemoryError when the client sends a multipart request with a part...

be.tomcools:dropwizard-websocket-jsr356-bundle (4.0.0-beta.1), ch.exense.rtm:rtm (3.0.0) +628 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (>=11.0.0, <=11.0.13)

org.eclipse.jetty:jetty-server MAVEN version =11.0.0, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.24.1, =3.23.0, =3.20.0, =3.20.0, =3.20.0, =3.22.0, =3.25.5 and more Source cves: CVE-2023-26048 Source advisory: GHSA-QW69-RQJ8-6QW8...

ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8), ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10) +9843 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (>=9.0.0.m0, <=9.4.50.v20221201)

org.eclipse.jetty:jetty-server MAVEN version =9.0.0.m0, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.1.7, =0.1.7, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

ai.catboost:catboost-spark_3.1_2.12 (>=1.0.1, <=1.2.8), ai.catboost:catboost-spark_3.2_2.12 (>=1.0.6, <=1.2.10) +9843 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (>=9.0.0.m0, <=9.4.50.v20221201)

org.eclipse.jetty:jetty-server MAVEN version =9.0.0.m0, =1.0.1, =1.0.6, =1.0.6, =1.1, =1.1.1, =1.2, =1.2, =1.2.3, =1.2.3, =0.1.7, =0.1.7, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744, =v1.1.0-226-g847ecff2d8e26f249422247d7665fe15f07b1744,...

com.cloudhopper:ch-jetty (1.0.2), com.cloudhopper:ch-mq-remote (>=3.0.3, <=3.0.4) +57 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (7.6.14.v20131031)

org.eclipse.jetty:jetty-server MAVEN version 7.6.14.v20131031 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.cloudhopper:ch-jetty 1.0.2 - com.cloudhopper:ch-mq-remote =3.0.3,...

org.apache.felix:org.apache.felix.http.bundle (2.2.2), org.apache.felix:org.apache.felix.http.jetty (2.2.2) +52 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (7.6.13.v20130916)

org.eclipse.jetty:jetty-server MAVEN version 7.6.13.v20130916 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.apache.felix:org.apache.felix.http.bundle 2.2.2 -...

com.yammer.dropwizard:dropwizard-client (0.1.0), com.yammer.dropwizard:dropwizard-core (0.1.0) +69 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (7.6.0.rc1)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc1 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.1.0 - com.yammer.dropwizard:dropwizard-core 0.1.0 -...

com.yammer.dropwizard:dropwizard-client (0.1.1), com.yammer.dropwizard:dropwizard-core (0.1.1) +50 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (7.6.0.rc2)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc2 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.1.1 - com.yammer.dropwizard:dropwizard-core 0.1.1 -...

com.yammer.dropwizard:dropwizard-client (0.1.2), com.yammer.dropwizard:dropwizard-core (0.1.2) +51 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (7.6.0.rc3)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc3 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.1.2 - com.yammer.dropwizard:dropwizard-core 0.1.2 -...

com.hmsonline:hms-cassandra-rest (>=0.15.0, <=1.0.0), com.hmsonline:virgil (>=0.16.0, <=1.0.1) +53 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (7.6.0.rc4)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.rc4 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.hmsonline:hms-cassandra-rest =0.15.0, =0.16.0, =1.0.1 -...

co.freeside:betamax (>=1.1, <=1.1.1), com.madgag:org.eclipse.jgit.junit.http (>=2.0.0.0.1-unofficial-roberto-release, <=2.99.99.2.0-unofficial-roberto-release) +187 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (7.6.0.v20120127)

org.eclipse.jetty:jetty-server MAVEN version 7.6.0.v20120127 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - co.freeside:betamax =1.1, =2.0.0.0.1-unofficial-roberto-release, =2.0.0, =2.2.4, =2.2.2,...

com.yammer.dropwizard:dropwizard-client (0.2.1), com.yammer.dropwizard:dropwizard-core (0.2.1) +53 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (7.6.1.v20120215)

org.eclipse.jetty:jetty-server MAVEN version 7.6.1.v20120215 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - com.yammer.dropwizard:dropwizard-client 0.2.1 - com.yammer.dropwizard:dropwizard-core 0.2...

org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer (1.2.1), org.eclipse.jetty.aggregate:jetty-all (7.6.2.v20120308) +53 more potentially affected by CVE-2023-26048 via org.eclipse.jetty:jetty-server (7.6.2.v20120308)

org.eclipse.jetty:jetty-server MAVEN version 7.6.2.v20120308 is affected by a known vulnerability. The following packages have a transitive dependency on org.eclipse.jetty:jetty-server and may be impacted: - org.codehaus.cargo:cargo-jetty-7-and-onwards-deployer 1.2.1 -...