CVE-2023-36478 | CWE-190
Denial Of Service (DoS): org.eclipse.jetty is vulnerable to Denial Of Service (DoS). The vulnerability arises from the library's failure to appropriately limit the size in HPACK header values. This allows an attacker to repeatedly send maliciously crafted HTTP messages, leading to an integer overflow and ultimately causing an application crash through the checkSize function in MetaDataBuilder.java.
CVE-2023-40167| CWE-130
HTTP Request Smuggling: Jetty is vulnerable to HTTP Request Smuggling. The vulnerability is due to accepting + character proceeding the content-length in the request. This vulnerability can be exploited by the attacker to possibly conduct request smuggling attacks.
Description
Veracode CVEs fix in jetty-http jar.
CVE-2023-36478 | CWE-190 Denial Of Service (DoS): org.eclipse.jetty is vulnerable to Denial Of Service (DoS). The vulnerability arises from the library's failure to appropriately limit the size in HPACK header values. This allows an attacker to repeatedly send maliciously crafted HTTP messages, leading to an integer overflow and ultimately causing an application crash through the
checkSize
function inMetaDataBuilder.java
.CVE-2023-40167| CWE-130 HTTP Request Smuggling: Jetty is vulnerable to HTTP Request Smuggling. The vulnerability is due to accepting
+
character proceeding the content-length in the request. This vulnerability can be exploited by the attacker to possibly conduct request smuggling attacks.