PT-2023-25586
CVE-2023-36478
·
تاريخ النشر
2023-10-10
·
تاريخ التحديث
2025-09-29
الوصف من
CVSS 3.1
7.5
عاليةالمقاييسAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Name of the Vulnerable Software and Affected Versions
Eclipse Jetty versions 9.0.0 through 9.4.52
Eclipse Jetty versions 10.0.0 through 10.0.15
Eclipse Jetty versions 11.0.0 through 11.0.15
Description
The issue is caused by an integer overflow in
MetaDataBuilder.checkSize, allowing HTTP/2 HPACK header values to exceed their size limit. When the length is very large and huffman is true, the multiplication by 4 will overflow, and the length will become negative. This can lead to a very large buffer allocation later on when the user-entered size is multiplied by 2. Users of HTTP/2 can be impacted by a remote denial of service attack.Recommendations
For Eclipse Jetty versions 9.0.0 through 9.4.52, upgrade to version 9.4.53 or later.
For Eclipse Jetty versions 10.0.0 through 10.0.15, upgrade to version 10.0.16 or later.
For Eclipse Jetty versions 11.0.0 through 11.0.15, upgrade to version 11.0.16 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
الباحثون
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾