PT-2021-5795 · Eclipse+3 · Eclipse Jetty+3

Published 2021-02-26 · Updated 2025-09-29 · CVE-2020-27223

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 9.4.6.v20170531 through 9.4.36.v20210114 Eclipse Jetty version 10.0.0 Eclipse Jetty version 11.0.0

Description The issue is related to the handling of requests containing multiple Accept headers with a large number of quality parameters, which can cause the server to enter a denial of service state due to high CPU usage. This can result in minutes of CPU time being exhausted. The features within Jetty that can trigger this behavior include default error handling, StatisticsServlet, HttpServletRequest.getLocale(), HttpServletRequest.getLocales(), and DefaultServlet.

Recommendations For Eclipse Jetty versions 9.4.6.v20170531 through 9.4.36.v20210114, update to version 9.4.37.v20210219 or greater. For Eclipse Jetty version 10.0.0, update to version 10.0.1 or greater. For Eclipse Jetty version 11.0.0, update to version 11.0.1 or greater. As a temporary workaround, consider avoiding the use of quality ordered values by not using the default error page/handler, not deploying the StatisticsServlet exposed to the network, not calling the getLocale API, and not enabling precompressed static content in the DefaultServlet.

Exploit

Fix

DoS

Resource Exhaustion

Weakness Enumeration

CWE-407

CWE-400

Related Identifiers

ALSA-2025_16880

ALT-PU-2021-1992

BDU:2022-00250

BIT-NIFI-2020-27223

BIT-SOLR-2020-27223

BIT-SPARK-2020-27223

CVE-2020-27223

DSA-4949-1

GHSA-M394-8RWW-3JR7

OESA-2021-1166

OPENSUSE-SU-2024:10878-1

RHSA-2021:2431

RHSA-2021:2499

RHSA-2021:2517

SUSE-SU-2021:0940-1

SUSE-SU-2021_0940-1

Affected Products

Alt Linux

Astra Linux

Eclipse Jetty

Suse

References · 166

• 🔥 https://github.com/motikan2010/CVE-2020-27223 · Exploit
• https://github.com/jetty/jetty.project/commit/10e531756b972162eed402c44d0244f7f6b85131 · Patch
• https://debian.org/security/2021/dsa-4949 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-solr-2020-27223 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28165 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2020-27223 · Vendor Advisory
• https://osv.dev/vulnerability/SUSE-SU-2021:0940-1 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-spark-2020-27223 · Vendor Advisory
• https://osv.dev/vulnerability/BIT-nifi-2020-27223 · Vendor Advisory
• https://ubuntu.com/security/CVE-2020-27223 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2020-27223 · Security Note
• https://bdu.fstec.ru/vul/2022-00250 · Security Note
• https://osv.dev/vulnerability/GHSA-m394-8rww-3jr7 · Vendor Advisory
• https://osv.dev/vulnerability/DSA-4949-1 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-27223 · Vendor Advisory