CVE-2023-40167

Name of the Vulnerable Software and Affected Versions Jetty versions prior to 9.4.52 Jetty versions prior to 10.0.16 Jetty versions prior to 11.0.16 Jetty versions prior to 12.0.1

Description Jetty is a Java-based web server and servlet engine. It accepts the + character proceeding the content-length value in a HTTP/1 header field, which is more permissive than allowed by the RFC. Other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if Jetty is used in combination with a server that does not close the connection after sending such a 400 response.

Recommendations Update to version 9.4.52 or later Update to version 10.0.16 or later Update to version 11.0.16 or later Update to version 12.0.1 or later