Skip to content
Fencer Vulns
medium 5.2

CVE-2020-27223 json

DOS vulnerability for Quoted Quality CSV headers

published 2021-02-26 5 y ago modified 2026-09-10 59 d ago also BIT-nifi-2020-27223 , BIT-solr-2020-27223 , BIT-spark-2020-27223 , EUVD-2021-0679 , GHSA-m394-8rww-3jr7

cvss
5.2
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
78.0%
EPSS 78.0% chance of exploitation in 30 days, percentile 99.5%
public exploits
0
none known

Summary

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Patch / fix

  • maven org.eclipse.jetty:jetty-server 9.4.37, 10.0.1, 11.0.1
  • bitnami solr 8.8.2
  • bitnami spark 3.1.2
  • eclipse jetty 9.4.36
  • oracle rest_data_services 20.4.3.050.1904
  • jetty9 Debian 14, Debian 13, Debian 12 9.4.38-1

debian advisories DEBIAN-CVE-2020-27223

  • jenkins openshift 4.5 2.277.3.1623846768-1.el7
  • jenkins-2-plugins openshift 4.5 4.5.1623326336-1.el7
  • jenkins openshift 3.11 2.289.1.1624365627-1.el7
  • jenkins-2-plugins openshift 3.11 3.11.1624366838-1.el7
  • jenkins openshift 4.6 2.277.3.1623853726-1.el8

red hat advisories RHSA-2021:2431RHSA-2021:2517RHSA-2021:2499

  • jetty-minimal SLE Module for Development Tools 15 SP2 9.4.38-3.6.2

suse advisories SUSE-SU-2021:0940-1

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2020-27223 updated cvss 5.3

jetty: request containing multiple Accept headers with a large number of "quality" parameters may lead to DoS

  • Red Hat Enterprise Linux 6 jetty-eclipse Red Hat Enterprise Linux 7 jetty-io, jetty-ant, jetty-jmx, jetty-jsp, jetty-xml, jetty-http, +30 more
    affected: no fix planned “Out of support scope”
  • Red Hat Enterprise Linux 8 jetty-io, jetty-http, jetty-util, jetty-server, jetty-servlet, jetty-security, +1 more
    affected: no fix planned “Will not fix”
  • Red Hat Integration Camel Quarkus 1 jetty
    affected: no fix available
  • Red Hat JBoss A-MQ 6 jetty Red Hat JBoss Fuse 6 jetty Red Hat JBoss Fuse Service Works 6 jetty
    affected: no fix planned “Out of support scope”
  • Red Hat OpenShift Container Platform 4 openshift4/ose-metering-hive, openshift4/ose-metering-hadoop, openshift4/ose-metering-presto
    affected: no fix planned “Will not fix”
  • Red Hat AMQ 7.8.2
    fixed: vendor fix RHSA-2021:2689
  • Red Hat AMQ 7.9.0
    fixed: vendor fix RHSA-2021:3700
  • Red Hat Fuse 7.10
    fixed: vendor fix RHSA-2021:5134
show 7 more
  • Red Hat Integration Camel Quarkus 2
    fixed: vendor fix RHSA-2021:4767
  • Red Hat Migration Toolkit 1.4 rhmtc/openshift-migration-ui-rhel8 v1.4.6-4, rhmtc/openshift-velero-plugin-rhel8 v1.4.6-4, rhmtc/openshift-migration-velero-rhel8 v1.4.6-5, rhmtc/openshift-migration-registry-rhel8 v1.4.6-4, rhmtc/openshift-migration-operator-bundle v1.4.6-5, rhmtc/openshift-migration-controller-rhel8 v1.4.6-4, +7 more
    fixed: vendor fix RHBA-2021:2854
  • Red Hat OpenShift Container Platform 3.11 jenkins 2.289.1.1624365627-1.el7
    fixed: vendor fix RHSA-2021:2517
  • Red Hat OpenShift Container Platform 4.5 jenkins 2.277.3.1623846768-1.el7
    fixed: vendor fix RHSA-2021:2431
  • Red Hat OpenShift Container Platform 4.6 jenkins 2.277.3.1623853726-1.el8
    fixed: vendor fix RHSA-2021:2499
  • Red Hat RHAF Camel-K 1.8
    fixed: vendor fix RHSA-2022:6407
  • Red Hat Decision Manager 7 jetty Red Hat OpenShift Container Platform 3.11 python-requests 2.19.1-5.el7, python2-requests 2.19.1-5.el7, prometheus 3.11.462-1.git.99aae51.el7, jenkins-2-plugins 3.11.1624366838-1.el7, openshift-kuryr 3.11.462-1.git.c33a657.el7, atomic-openshift 3.11.462-1.git.0.e7d0362.el7, +37 more Red Hat OpenShift Container Platform 4.5 jenkins-2-plugins 4.5.1623326336-1.el7, openshift 4.5.0-202106011407.p0.git.d8ef5ad.el7, openshift 4.5.0-202106011407.p0.git.d8ef5ad.el8, openshift-kuryr 4.5.0-202106011407.p0.git.75cc301.el8, openshift-ansible 4.5.0-202106011407.p0.git.83db419.el7, openshift-clients 4.5.0-202106011407.p0.git.297a4ac.el7, +12 more Red Hat OpenShift Container Platform 4.6 cri-o 1.19.2-6.rhaos4.6.git686e6d9.el7, cri-o 1.19.2-6.rhaos4.6.git686e6d9.el8, openshift-kuryr 4.6.0-202106181055.p0.git.7feb5bd.el8, openshift-clients 4.6.0-202106160917.p0.git.99556b6.el7, openshift-clients 4.6.0-202106160917.p0.git.99556b6.el8, openshift-kuryr-cni 4.6.0-202106181055.p0.git.7feb5bd.el8, +5 more Red Hat Process Automation 7 jetty Red Hat Single Sign-On 7 jetty
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

78.03% chance of exploitation in the next 30 days, higher than 99.5% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 5.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
GitHub 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 3.1 5.3 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P
OSV 3.1 5.2 CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.eclipse.jetty:jetty-server
>=9.4.6, <9.4.37
>=10.0.0, <10.0.1
>=11.0.0, <11.0.1
9.4.37
10.0.1
11.0.1
bitnami nifi
>=1.13.0, <=1.13.0
 no fix listed
bitnami solr
>=8.8.1, <8.8.2
8.8.2
bitnami spark
>=3.1.1, <3.1.2
3.1.2

Affected products

  • The Eclipse Foundation Eclipse Jetty

Classification

Weakness
  • CWE-407 Inefficient Algorithmic Complexity
  • CWE-400 Uncontrolled Resource Consumption

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.