ZeroHour
DashboardNewsCVEsExploitsIncidentsAIBriefAnalyticsEntitiesWatchlistIOCsAsk the feedSourcesFeeds & APIKiosk mode

CVE-2020-27223

—
CVSS 3.1
5.3 medium
EPSS
78%p100
Published
()
Modified
Description

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Vendors
eclipseapachenetappdebianoracle
Products
jetty, nifi, spark, e-series santricity os controller, e-series santricity web services, element plug-in for vcenter server, hci, hci management node, management services for element software, snap creator framework, snapcenter, snapmanager
Weakness
CWE-407, CWE-400
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
NVD CVE.org GitHub PoCs EPSS (78.0%)

In the news

No ingested article mentions this CVE yet.