Homepage
About Snyk

org.eclipse.jetty:jetty-http@12.0.0 vulnerabilities

Go back to all versions of this package
Report a new vulnerability Found a mistake?

Direct Vulnerabilities

Known vulnerabilities in the org.eclipse.jetty:jetty-http package. This does not include vulnerabilities belonging to this package’s dependencies.

Automatically find and fix vulnerabilities affecting your projects. Snyk scans for vulnerabilities and provides fixes for free.
Fix for free
Vulnerability Vulnerable Version
  • M
Improper Handling of Length Parameter Inconsistency

org.eclipse.jetty:jetty-http is an is a http module for jetty server.

Affected versions of this package are vulnerable to Improper Handling of Length Parameter Inconsistency via the HttpParser.java component due to accepting the + character proceeding the content-length value in a HTTP/1 header field. An attacker can use jetty in combination with a server that does not close the connection after rejecting such request and after sending a 400 response. This could result in request smuggling.

How to fix Improper Handling of Length Parameter Inconsistency?

Upgrade org.eclipse.jetty:jetty-http to version 9.4.52.v20230823, 10.0.16, 11.0.16, 12.0.1 or higher.

[9.0.0.M0,9.4.52.v20230823) [10.0.0,10.0.16) [11.0.0,11.0.16) [12.0.0,12.0.1)
Go back to all versions of this package