CVE-2023-364787.5HighCWE-190

CVE-2023-36478: HTTP/2 HPACK integer overflow and buffer allocation

eclipse · jetty.project

Affected: eclipse jetty.project · Exploitation: possible (1 to 10%)

Not in CyberSIXT coverage yet: no article names this CVE. This page shows the public record.

4.8%probability of exploitation in the next 30 days

92nd percentile

050100

Higher than 92% of scored CVEs

7.5HighCVSS 3.1

LowMediumHighCrit.

DescriptionCVE.org

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

Affected products1

From the CVE record. A product or version that is not listed is unknown, not unaffected.

eclipse · jetty.project>= 10.0.0, < 10.0.16; >= 11.0.0, < 11.0.16; >= 9.3.0, < 9.4.53

On the Atlas

Every published CVE is on the CyberSIXT Atlas, grouped by weakness, vendor and month.

Open the Atlas

Exploitation: Possible (1 to 10%). EPSS between 1% and 10%.
CISA KEV: Not listed
Public check: No public nuclei template
Weakness: Integer Overflow · Memory Corruption
Vendor: eclipse
Published: October 2023
Band: Possible (1 to 10%), October 2023

CoverageNo articles yet

No CyberSIXT article names CVE-2023-36478 yet, so there is no coverage timeline, action brief or change log for it. Everything on this page comes from the public CVE record, CISA KEV, EPSS and the nuclei template index. Search the archive or see the CVEs in the news.