CVEvulnerability

CVE-2020-27223

5.3 MEDIUM Published 2021-02-26 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2021-02-26
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.1 ([email protected])
5.2 MEDIUM — CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:N/I:N/A:H
CVSS 3.1 ([email protected])
5.3 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:N/I:N/A:P
Weaknesses
CWE-400, CWE-407

Description

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Affected configurations

• eclipse jetty (>= 9.4.7 < 9.4.36) • eclipse jetty 9.4.6 • eclipse jetty 9.4.36 • eclipse jetty 10.0.0 • eclipse jetty 11.0.0 • apache nifi 1.13.0 • apache spark 3.1.1 • netapp e-series santricity os controller (>= 11.0.0 <= 11.70.1) • netapp e-series santricity web services • netapp element plug-in for vcenter server • netapp hci • netapp hci management node • netapp management services for element software • netapp snap creator framework • netapp snapcenter • netapp snapmanager • netapp solidfire • debian debian linux 10.0 • apache solr 8.8.1 • oracle rest data services (< 20.4.3.050.1904)

Related

Weakness · CWE (2)

  • CWE-400 Uncontrolled Resource Consumption weakness
  • CWE-407 Inefficient Algorithmic Complexity weakness

References