Attestkeep
Language: English
Sign up

Vulnerabilities / CVE-2017-7657

critical

CVE-2017-7657

jetty: HTTP request smuggling

Published Modified CWE 444, 190
In the Trivy database since at least 24 Oct 2026, 07:11 UTCWhen it arrived before that build is not recorded.

Severity by source

NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
GHSA9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Red Hat9.8CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Trivy's own label is CRITICAL. Rated critical by NVD, GHSA. Rated lower by Red Hat (high), Ubuntu (low).

Description

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.

Affected packages and fixed versions

SourcePackageFixed in
maven::GitHub Security Advisory Mavenorg.eclipse.jetty:jetty-server9.2.25.v20180606, 9.3.24.v20180605
debian 11jetty99.2.25-1
debian 12jetty99.2.25-1
debian 13jetty99.2.25-1
debian 14jetty99.2.25-1
debian 8jetty, jetty8no fix listed
debian 9jetty99.2.21-1+deb9u1
echojetty99.2.25-1
Red Hatjetty-annotations, jetty-ant, jetty-client and 70 moreno fix listed
ubuntu 18.04-ESMjetty9no fix listed
Show all 83 entries from 10 sources
SourcePackageFixed in
maven::GitHub Security Advisory Mavenorg.eclipse.jetty:jetty-server9.2.25.v20180606, 9.3.24.v20180605
debian 11jetty99.2.25-1
debian 12jetty99.2.25-1
debian 13jetty99.2.25-1
debian 14jetty99.2.25-1
debian 8jettyno fix listed
debian 8jetty8no fix listed
debian 9jetty99.2.21-1+deb9u1
echojetty99.2.25-1
Red Hatjetty-annotationsno fix listed
Red Hatjetty-antno fix listed
Red Hatjetty-clientno fix listed
Red Hatjetty-continuationno fix listed
Red Hatjetty-deployno fix listed
Red Hatjetty-eclipseno fix listed
Red Hatjetty-httpno fix listed
Red Hatjetty-iono fix listed
Red Hatjetty-jaasno fix listed
Red Hatjetty-jaspino fix listed
Red Hatjetty-javadocno fix listed
Red Hatjetty-jmxno fix listed
Red Hatjetty-jndino fix listed
Red Hatjetty-jspno fix listed
Red Hatjetty-jspc-maven-pluginno fix listed
Red Hatjetty-maven-pluginno fix listed
Red Hatjetty-monitorno fix listed
Red Hatjetty-plusno fix listed
Red Hatjetty-projectno fix listed
Red Hatjetty-proxyno fix listed
Red Hatjetty-rewriteno fix listed
Red Hatjetty-runnerno fix listed
Red Hatjetty-securityno fix listed
Red Hatjetty-serverno fix listed
Red Hatjetty-servletno fix listed
Red Hatjetty-servletsno fix listed
Red Hatjetty-startno fix listed
Red Hatjetty-utilno fix listed
Red Hatjetty-util-ajaxno fix listed
Red Hatjetty-webappno fix listed
Red Hatjetty-websocket-apino fix listed
Red Hatjetty-websocket-clientno fix listed
Red Hatjetty-websocket-commonno fix listed
Red Hatjetty-websocket-parentno fix listed
Red Hatjetty-websocket-serverno fix listed
Red Hatjetty-websocket-servletno fix listed
Red Hatjetty-xmlno fix listed
Red Hatrh-java-common-jetty-annotationsno fix listed
Red Hatrh-java-common-jetty-antno fix listed
Red Hatrh-java-common-jetty-clientno fix listed
Red Hatrh-java-common-jetty-continuationno fix listed
Red Hatrh-java-common-jetty-deployno fix listed
Red Hatrh-java-common-jetty-httpno fix listed
Red Hatrh-java-common-jetty-iono fix listed
Red Hatrh-java-common-jetty-jaasno fix listed
Red Hatrh-java-common-jetty-jaspino fix listed
Red Hatrh-java-common-jetty-javadocno fix listed
Red Hatrh-java-common-jetty-jmxno fix listed
Red Hatrh-java-common-jetty-jndino fix listed
Red Hatrh-java-common-jetty-jspno fix listed
Red Hatrh-java-common-jetty-jspc-maven-pluginno fix listed
Red Hatrh-java-common-jetty-maven-pluginno fix listed
Red Hatrh-java-common-jetty-monitorno fix listed
Red Hatrh-java-common-jetty-plusno fix listed
Red Hatrh-java-common-jetty-projectno fix listed
Red Hatrh-java-common-jetty-proxyno fix listed
Red Hatrh-java-common-jetty-rewriteno fix listed
Red Hatrh-java-common-jetty-runnerno fix listed
Red Hatrh-java-common-jetty-securityno fix listed
Red Hatrh-java-common-jetty-serverno fix listed
Red Hatrh-java-common-jetty-servletno fix listed
Red Hatrh-java-common-jetty-servletsno fix listed
Red Hatrh-java-common-jetty-startno fix listed
Red Hatrh-java-common-jetty-utilno fix listed
Red Hatrh-java-common-jetty-util-ajaxno fix listed
Red Hatrh-java-common-jetty-webappno fix listed
Red Hatrh-java-common-jetty-websocket-apino fix listed
Red Hatrh-java-common-jetty-websocket-clientno fix listed
Red Hatrh-java-common-jetty-websocket-commonno fix listed
Red Hatrh-java-common-jetty-websocket-parentno fix listed
Red Hatrh-java-common-jetty-websocket-serverno fix listed
Red Hatrh-java-common-jetty-websocket-servletno fix listed
Red Hatrh-java-common-jetty-xmlno fix listed
ubuntu 18.04-ESMjetty9no fix listed

References

All 21 references

Vulnerability data compiled from the Trivy vulnerability database (trivy-db, Aqua Security, Apache License 2.0), which aggregates third-party advisories. CVE records are published by The MITRE Corporation under the CVE Terms of Use; CVE is a trademark of MITRE. This product uses data from the NVD API but is not endorsed or certified by the NVD. Severity, titles and advisory data from the GitHub Advisory Database (CC BY 4.0), Red Hat security data (CC BY 4.0) and the other sources linked on each entry. Entries may be summarised or re-formatted; the linked original is the authoritative record.