Log in Start free

Vulnerability · Published Apr 18, 2023 · Assigned by GitHub_M

CVE-2023-26048OutOfMemoryError for large multipart without filename in Eclipse Jetty

Medium 5.3

In plain English

A medium-severity uncontrolled resource consumption in jetty.project from eclipse. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 3.4% (higher than 89% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Fixed versions are available - upgrade the affected package.

Severity (CVSS 3.1)5.3Medium
Exploit odds (30 days)3.4%top 11.2% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack tooling1Public PoC

Official description

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:12jetty99.4.50-4+deb12u1DEBIAN-CVE-2023-26048
Debian:12jetty99.4.50-4+deb12u1DSA-5507-1
Debian:13jetty99.4.52-1DEBIAN-CVE-2023-26048
Debian:14jetty99.4.52-1DEBIAN-CVE-2023-26048
Mavenorg.eclipse.jetty:jetty-server11.0.14GHSA-qw69-rqj8-6qw8
Mavenorg.eclipse.jetty:jetty-server9.4.51.v20230217GHSA-qw69-rqj8-6qw8
Mavenorg.eclipse.jetty:jetty-server10.0.14GHSA-qw69-rqj8-6qw8

Affected products (as reported)

VendorProductVersions
eclipse jetty.project < 9.4.51>= 10.0.0, < 10.0.14>= 11.0.0, < 11.0.14

Weakness: CWE-400 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

References