CVE-2017-7658: Jetty Server Authorization Bypass
Summary
CVE-2017-7658: Eclipse Jetty Server versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), are vulnerable to HTTP Request Smuggling when presented with two content-lengths headers, a... Affects org.eclipse.jetty:jetty-server across 3 version ranges.
< 9.2.25.v20180606
>= 9.3.0, < 9.3.24.v20180605
>= 9.4.0, < 9.4.11.v20180605
Fixed in 9.2.25.v20180606, 9.3.24.v20180605 or 9.4.11.v20180605, depending on the release line you run. How to fix ↓
Also tracked for
- jetty9 · Debian:11
The same CVE-2017-7658 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
The Jetty Server is an open-source HTTP server and servlet container that is widely used for Java web applications. It provides a lightweight and scalable solution for serving web content. The vulnerability identified as CVE-2017-7658 affects versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations) of the Jetty Server. This vulnerability allows for authorization bypass through inconsistent handling of HTTP requests, specifically related to HTTP Request Smuggling.
Vulnerability Detail
The vulnerability arises when the Jetty Server receives two content-length headers, one with a specific length and another with chunked encoding. According to RFC 2616, the content-length header should take precedence over chunked encoding. However, in affected versions of Jetty, if an intermediary decides on the shorter length but still passes on the longer body, Jetty interprets the body content as a pipelined request. This fake pipelined request can bypass authorization mechanisms imposed by intermediaries, leading to potential unauthorized access to protected resources.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
< 9.2.25.v201806069.2.25.v20180606 -
>= 9.3.0, < 9.3.24.v201806059.3.24.v20180605 -
>= 9.4.0, < 9.4.11.v201806059.4.11.v20180605
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, it is possible to mitigate the vulnerability by configuring the intermediary servers to reject or strip out duplicate content-length headers. This can help prevent the inconsistent handling of requests that leads to the authorization bypass. However, applying the fix by upgrading to the fixed versions of Jetty Server is the recommended long-term solution.
Conclusion
The CVE-2017-7658 vulnerability in Jetty Server allows for authorization bypass through inconsistent handling of HTTP requests. Upgrading to the fixed versions of Jetty Server is the recommended solution to mitigate this vulnerability. For further support and assistance in vulnerability remediation, please contact DevNack.com.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The vulnerability allows for authorization bypass, potentially granting unauthorized access to protected resources.
Versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations) of Jetty Server are affected.
You can use the Vulert Playground at Vulert Scanner to check if your application is affected by this vulnerability. Simply provide your pom.xml file, and Vulert will analyze it in real-time.
Yes, the CVSS score for this vulnerability is 9.8, indicating a critical severity level.
There are no known public exploits for this vulnerability at the time of this report. However, it is crucial to apply the recommended fix to prevent potential unauthorized access.
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
