Skip to content
Fencer Vulns
high 7.5

CVE-2023-36478 json

HTTP/2 HPACK integer overflow and buffer allocation

published 2023-10-10 3 y ago modified 2026-09-10 59 d ago also BIT-jenkins-2023-36478 , EUVD-2023-2828 , GHSA-wgh7-54f2-x98r

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
4.8%
EPSS 4.8% chance of exploitation in 30 days, percentile 92%
public exploits
0
none known

Summary

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

Patch / fix

  • maven org.eclipse.jetty.http2:http2-hpack 9.4.53, 10.0.16, 11.0.16
  • maven org.eclipse.jetty.http3:http3-qpack 10.0.16, 11.0.16
  • bitnami jenkins 2.428.0
  • eclipse jetty 9.4.53, 10.0.16, 11.0.16
  • jenkins jenkins 2.414.3, 2.428
  • jetty9 Debian 12 9.4.50-4+deb12u2
  • jetty9 Debian 14, Debian 13 9.4.53-1

debian advisories DEBIAN-CVE-2023-36478

  • jetty-minimal SLES for SAP 15 SP3, SLES for SAP 15 SP2, SLES 15 SP3-LTSS +9 more 9.4.53-150200.3.22.1

suse advisories SUSE-SU-2023:4210-1

  • jetty-runner Alpine 3.24, Alpine 3.23, Alpine 3.22 +5 more 9.4.53.20231009-r0

alpine advisories ALPINE-CVE-2023-36478

Alpine secdb © Alpine Linux, from https://secdb.alpinelinux.org via OSV; changed: normalised to fixed package versions per release. CC BY-SA 4.0

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2023-36478 updated cvss 7.5

jetty: hpack header values cause denial of service in http/2

  • Red Hat OpenShift Developer Tools and Services jenkins
    affected: workaround, no fix available “No mitigations are currently available for this vulnerability.”
  • Red Hat Integration Camel Quarkus 2 http2-hpack Red Hat JBoss Fuse 6 jetty Red Hat JBoss Fuse Service Works 6 jetty Red Hat OpenShift Container Platform 3.11 jenkins, jetty-project
    affected: workaround, no fix planned “No mitigations are currently available for this vulnerability.”
  • Red Hat OpenShift Container Platform 4 jenkins Red Hat Satellite 6 puppetserver
    affected: workaround, no fix available “No mitigations are currently available for this vulnerability.”
  • Red Hat Fuse 7.12.1
    fixed: vendor fix “No mitigations are currently available for this vulnerability.” RHSA-2023:7247
  • Red Hat Fuse 7.13.0
    fixed: vendor fix “No mitigations are currently available for this vulnerability.” RHSA-2024:3354
  • Red Hat Enterprise Linux 7 jetty-io, jetty-ant, jetty-jmx, jetty-jsp, jetty-xml, jetty-http, +30 more Red Hat Enterprise Linux 8 jetty-io, jetty-http, jetty-util, jetty-server, jetty-servlet, jetty-security, +1 more Red Hat Enterprise Linux 9 jetty-project
    not affected: vulnerable code not present

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Exploit prediction

4.83% chance of exploitation in the next 30 days, higher than 92% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • github.com https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r referenced PoC, tagged "exploit" by a source, unverified

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
NVD 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
OSV 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.eclipse.jetty.http2:http2-hpack
>=10.0.0, <10.0.16
>=11.0.0, <11.0.16
>=9.3.0, <9.4.53
10.0.16
11.0.16
9.4.53
maven org.eclipse.jetty.http3:http3-qpack
>=10.0.0, <10.0.16
>=11.0.0, <11.0.16
10.0.16
11.0.16
bitnami jenkins
<2.428.0
2.428.0

Affected products

  • eclipse jetty.project

Classification

Weakness
  • CWE-190 Integer Overflow or Wraparound
  • CWE-400 Uncontrolled Resource Consumption
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.