HTTP Request Smuggling Affecting org.eclipse.jetty:jetty-server Open this link in a new tab package, versions [9.4.0.RC0, 9.4.35.v20201120) [10.0.0.alpha0, 10.0.0.beta3) [11.0.0.alpha0, 11.0.0.beta3)

  • Attack Complexity


Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • snyk-id


  • published

    29 Nov 2020

  • disclosed

    29 Nov 2020

  • credit

    easbar, karussell

How to fix?

Upgrade org.eclipse.jetty:jetty-server to version 9.4.35.v20201120, 10.0.0.beta3, 11.0.0.beta3 or higher.


org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine.

Affected versions of this package are vulnerable to HTTP Request Smuggling. If GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.