CVE-2023-26048: OutOfMemoryError for large multipart without filename in Eclipse Jetty

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• eclipse jettybefore 9.4.51
• eclipse jetty10.0.0 and later · before 10.0.14
• eclipse jetty11.0.0 and later · before 11.0.14

Versions reported by the vendor

Affected version ranges reported by the assigning authority (GitHub_M). Independent of NVD's CPE analysis and usually ahead of it.

• eclipse jetty.project

  • < 9.4.51, >= 10.0.0, < 10.0.14, >= 11.0.0, < 11.0.14affected

Package-level exposure

OSV and GitHub Advisory data: ecosystem, package and range. SBOM matching uses this table.

Other highest-scoring records for the same primary product.

• CVE-2021-34429For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded characters to access the con
  60This week
• CVE-2021-28164In Eclipse Jetty 9.4.37.v20210219 to 9.4.38.v20210224, the default compliance mode allows requests with URIs that contain %2e or %2e%2e segm
  60This week
• CVE-2015-2080The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote attackers to obtain sensitive information from process mem
  53Plan

Published before and after this one in the same product

• ← EarlierCVE-2022-2048Jul 7, 2022 · In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up no
  31Monitor
• ← EarlierCVE-2022-2191Jul 7, 2022 · In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured By
  31Monitor
• Later →CVE-2023-26049Apr 18, 2023 · Cookie parsing of quoted values can exfiltrate values from other cookies in Eclipse Jetty
  21Monitor

Root cause

Code that parses nested structures sets no depth or size limit. A small input can turn into a disproportionate processing load.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1function expand(node) {2  return node.children.map(expand);3}

1const MAX_DEPTH = 32;2function expand(node, depth = 0) {3  if (depth > MAX_DEPTH) throw new Error("too deep");4  return node.children.map((c) => expand(c, depth + 1));5}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.