What’s Vulnerable › Vulnerabilities

CVE-2020-27223

• Severity: medium (CVSS 5.3 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 78.0% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2021-02-26 · updated 2026-06-17
• Weakness: CWE-407

Description

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Affected products

• Apache Software Foundation Apache NiFi: 1.13.0
• Apache Software Foundation Apache Solr: 8.8.1
• Apache Software Foundation Apache Spark: 3.1.1
• Debian Linux: 10.0
• The Eclipse Foundation Eclipse Jetty: from 9.4.7 before 9.4.36; 9.4.6-20170531, 9.4.6-20180619, 9.4.36, 9.4.36-20210114, 10.0.0, 11.0.0 — fixed in 9.4.36
• E-Series SANtricity OS Controller Software 11.x: from 11.0.0 through 11.70.1
• NetApp E-Series Santricity Web Services: all versions
• NetApp, Inc. Element Plug-in for vCenter Server: all versions
• NetApp Hci: all versions
• NetApp Hci Management Node: all versions
• NetApp Management Services For Element Software: all versions
• NetApp Snap Creator Framework: all versions
• NetApp SnapCenter: all versions
• SnapManager for Oracle: all versions
• NetApp Solidfire: all versions
• Oracle Corporation Oracle REST Data Services: before 20.4.3.050.1904 — fixed in 20.4.3.050.1904

How to fix

Upgrade to a fixed version: The Eclipse Foundation Eclipse Jetty 9.4.36; Oracle Corporation Oracle REST Data Services 20.4.3.050.1904. Check the vendor advisory for mitigations.

References

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=571128
• https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7
• https://github.com/jetty/jetty.project/commit/10e531756b972162eed402c44d0244f7f6b85131
• https://lists.apache.org/thread.html/r068dfd35ce2193f6af28b74ff29ab148c2b2cacb235995576f5bea78%40%3Cissues.solr.apache.org%3E
• https://lists.apache.org/thread.html/r07aedcb1ece62969c406cb84c8f0e22cec7e42cdc272f3176e473320%40%3Cusers.solr.apache.org%3E
• https://lists.apache.org/thread.html/r0b639bd9bfaea265022125d18acd2fc6456044b76609ec74772c9567%40%3Cissues.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r0c6eced465950743f3041b03767a32b2e98d19731bd72277fc7ea428%40%3Ccommits.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r0cdab13815fc419805a332278c8d27e354e78560944fc36db0bdc760%40%3Cnotifications.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r0e25cdf3722a24c53049d37396f0da8502cb4b7cdc481650dc601dbc%40%3Cgitbox.activemq.apache.org%3E
• https://lists.apache.org/thread.html/r105f4e52feb051faeb9141ef78f909aaf5129d6ed1fc52e099c79463%40%3Cissues.spark.apache.org%3E
• https://lists.apache.org/thread.html/r1414ab2b3f4bb4c0e736caff6dc8d15f93f6264f0cca5c47710d7bb3%40%3Creviews.spark.apache.org%3E
• https://lists.apache.org/thread.html/r1b7ed296a865e3f1337a96ee9cd51f6d154d881a30da36020ca72a4b%40%3Cjira.kafka.apache.org%3E

Get alerted when CVE-2020-27223 or the next vulnerability affects your stack