In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to…

Description

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgraded, the vulnerability can be significantly reduced by configuring a responseHeaderSize significantly larger than the requestHeaderSize (12KB responseHeaderSize and 8KB requestHeaderSize).

Scores

EPSS (exploitation in 30 days)

11.1% · top 4.0% of all CVEs (6 Nov 2026)

The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.

Weakness

• CWE-672: Operation on a Resource after Expiration or Release (opens in a new tab)All about CWE-672 and its CVEs
• CWE-675: Duplicate Operations on Resource (opens in a new tab)All about CWE-675 and its CVEs

Affected products

• The Eclipse Foundation · Eclipse Jetty

  • affected 9.4.27.v20200227 to 9.4.29.v20200521

Affected packages

From reviewed advisories of the GitHub Advisory Database.

• Mavenorg.eclipse.jetty:jetty-serverGHSA-x3rh-m7vp-35f2 (opens in a new tab)

References (17)

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=564984 (opens in a new tab)x_refsource_CONFIRMx_transferred
• [oss-security] 20200817 Vulnerability in Jenkins (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• FEDORA-2020-cf8ef2f333 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
• [pulsar-commits] 20200903 [GitHub] [pulsar] guyv opened a new issue #7970: pulsar-client vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20200911 [GitHub] [pulsar] codelipenghui closed issue #7970: pulsar-client vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20200912 [GitHub] [pulsar] codelipenghui closed issue #7970: pulsar-client vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20200914 [GitHub] [pulsar] klwilson227 opened a new issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20200922 [GitHub] [pulsar] zymap commented on issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20200923 [GitHub] [pulsar] zymap commented on issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20200929 [GitHub] [pulsar] sijie closed issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20200929 [GitHub] [pulsar] sijie commented on issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20201005 [GitHub] [pulsar] abhishekheaven7 opened a new issue #8203: Pulsar client with version 2.6.1 has critical vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20201005 [GitHub] [pulsar] abhishekheaven7 closed issue #8203: Pulsar client with version 2.6.1 has critical vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuoct2020.html (opens in a new tab)x_refsource_MISCx_transferred
• [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• [pulsar-commits] 20210127 [GitHub] [pulsar] GLouMcK opened a new issue #9347: Security Vulnerabilities - Black Duck Scan (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
• https://www.oracle.com/security-alerts/cpuApr2021.html (opens in a new tab)x_refsource_MISCx_transferred

Sources

The same CVE in the primary databases and aggregators, to check against.

• CVE.org record (opens in a new tab)
• CVE List JSON (GitHub) (opens in a new tab)
• NVD (opens in a new tab)
• FIRST EPSS (opens in a new tab)
• OSV.dev (opens in a new tab)
• GitHub Advisory GHSA-x3rh-m7vp-35f2 (opens in a new tab)
• CIRCL Vulnerability-Lookup (opens in a new tab)

Badge for a README or a ticket

[![CVE-2019-17638](https://trackcve.app/badge/CVE-2019-17638.svg)](https://trackcve.app/cve/CVE-2019-17638)

Record last updated 5 Aug 2024, 01:47 UTC.