CVE-2023-26048
published 2023-04-18CVE-2023-26048: Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call…
PriorityP431medium5.3CVSS 3.1
AVNACLPRNUINSUCNINAL
EPSS
3.26%
87.0th percentile
Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | jetty9 | < jetty9 9.4.50-4+deb12u1 (bookworm) | jetty9 9.4.50-4+deb12u1 (bookworm) |
| eclipse | jetty | < 9.4.51 | 9.4.51 |
| eclipse | jetty | >= 10.0.0 < 10.0.14 | 10.0.14 |
| eclipse | jetty | >= 11.0.0 < 11.0.14 | 11.0.14 |
| eclipse | jetty.project | < 9.4.51 | 9.4.51 |
| eclipse | jetty.project | — | — |
| eclipse | jetty.project | — | — |
CVSS provenance
nvdv3.15.3MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
osv5.3MEDIUM
vendor_debian5.3MEDIUM
vendor_oracle5.3MEDIUM
vendor_redhat5.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
OutOfMemoryError for large multipart without filename in Eclipse Jetty
ghsa·2023-04-19
CVE-2023-26048 [MEDIUM] CWE-400 OutOfMemoryError for large multipart without filename in Eclipse Jetty
OutOfMemoryError for large multipart without filename in Eclipse Jetty
### Impact
Servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and a very large content.
This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk.
An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`.
However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time.
A very large number of parts may cause the same problem.
###
OSV
OutOfMemoryError for large multipart without filename in Eclipse Jetty
osv·2023-04-19
CVE-2023-26048 [MEDIUM] OutOfMemoryError for large multipart without filename in Eclipse Jetty
OutOfMemoryError for large multipart without filename in Eclipse Jetty
### Impact
Servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and a very large content.
This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk.
An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`.
However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time.
A very large number of parts may cause the same problem.
###
OSV
CVE-2023-26048: Jetty is a java based web server and servlet engine
osv·2023-04-18·CVSS 5.3
CVE-2023-26048 [MEDIUM] CVE-2023-26048: Jetty is a java based web server and servlet engine
Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users
Oracle
Oracle Oracle Communications Risk Matrix: Signaling (Eclipse Jetty) — CVE-2023-26048
vendor_oracle·2023-10-15·CVSS 5.3
CVE-2023-26048 [MEDIUM] Oracle Oracle Communications Risk Matrix: Signaling (Eclipse Jetty) — CVE-2023-26048
Oracle Oracle Communications Risk Matrix: Signaling (Eclipse Jetty) vulnerability
CVE: CVE-2023-26048
CVSS: 5.3
Protocol: HTTP
Remote exploit: Yes
Affected versions: Network
Advisory: cpuoct2023 (OCT 2023)
Red Hat
jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()
vendor_redhat·2023-04-18·CVSS 5.3
CVE-2023-26048 [MEDIUM] CWE-770 jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()
jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()
Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- althoug
Debian
CVE-2023-26048: jetty9 - Jetty is a java based web server and servlet engine. In affected versions servle...
vendor_debian·2023·CVSS 5.3
CVE-2023-26048 [MEDIUM] CVE-2023-26048: jetty9 - Jetty is a java based web server and servlet engine. In affected versions servle...
Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users
No detection rules found.
No public exploits indexed.
https://github.com/eclipse/jetty.project/issues/9076https://github.com/eclipse/jetty.project/pull/9344https://github.com/eclipse/jetty.project/pull/9345https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8https://github.com/jakartaee/servlet/blob/6.0.0/spec/src/main/asciidoc/servlet-spec-body.adoc#32-file-uploadhttps://lists.debian.org/debian-lts-announce/2023/09/msg00039.htmlhttps://security.netapp.com/advisory/ntap-20230526-0001/https://www.debian.org/security/2023/dsa-5507https://github.com/eclipse/jetty.project/issues/9076https://github.com/eclipse/jetty.project/pull/9344https://github.com/eclipse/jetty.project/pull/9345https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8https://github.com/jakartaee/servlet/blob/6.0.0/spec/src/main/asciidoc/servlet-spec-body.adoc#32-file-uploadhttps://lists.debian.org/debian-lts-announce/2023/09/msg00039.htmlhttps://security.netapp.com/advisory/ntap-20230526-0001/https://www.debian.org/security/2023/dsa-5507
2023-04-18
Published