CVE-2020-27223: Denial of Service Vulnerability in org.eclipse.jetty:jetty-server

org.eclipse.jetty:jetty-server Updated 02 Oct 2025

Summary

10/03/2021

Disclosed on

CVE-2020-27223

CVE

Yes i

Fix available

Moderate

Severity

5.3

CVSS Score

CVE-2020-27223: DOS vulnerability for Quoted Quality CSV headers. Affects org.eclipse.jetty:jetty-server across 3 version ranges.

>= 9.4.6, < 9.4.37 >= 10.0.0, < 10.0.1 >= 11.0.0, < 11.0.1

Fixed in 9.4.37, 10.0.1 or 11.0.1, depending on the release line you run. How to fix ↓

Also tracked for

nifi · Bitnami
solr · Bitnami
spark · Bitnami
jetty9 · Debian:11

The same CVE-2020-27223 is tracked separately for each ecosystem and vendor. Its fix information is the same; the package and affected versions differ.

Free scan

Check if this vulnerability affects your application

Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.

Check my app free

No signup required · Results in about 60 seconds

Upload your dependency manifest or SBOM

Drag & drop your file here or Browse

Java Javascript PHP Python Go Rust Ruby Dart C/C++ Elixir CycloneDX SPDX

Upload a supported dependency manifest or SBOM. No installation or source-code access required.

See supported files and SBOM formats

SBOM sbom.json · bom.json · bom.xml · *.spdx.json · *.cdx.json · *.cdx.xml

Java pom.xml · gradle.lockfile · buildscript-gradle.lockfile

Javascript package-lock.json · yarn.lock · pnpm-lock.yaml

PHP composer.lock

Python poetry.lock · requirements.txt · Pipfile.lock

Go go.mod

Rust Cargo.lock

Ruby Gemfile.lock

Dart pubspec.lock

C/C++ conan.lock

Elixir mix.lock

Enter your work email to receive your report link.

Verify your email to view the full report and start 30 days of continuous monitoring. No credit card required.

Background

The org.eclipse.jetty:jetty-server package is a Java-based HTTP server and servlet container. It provides a powerful and flexible foundation for web applications. The vulnerability in this package allows an attacker to trigger a denial of service (DoS) condition by sending a request with a large number of 'quality' parameters in the request headers. This causes high CPU usage and can consume significant amounts of CPU time, leading to a DoS state. The affected versions of the package range from 9.4.6.v20170531 to 9.4.36.v20210114, 10.0.0, and 11.0.0.

Vulnerability Detail

The vulnerability arises when Jetty handles a request with request headers containing a large number of 'quality' parameters. This behavior is triggered by features such as default error handling, the StatisticsServlet, HttpServletRequest.getLocale(), HttpServletRequest.getLocales(), and DefaultServlet. The server enters a DoS state due to high CPU usage while sorting the list of values based on their quality values. This can result in a single request consuming minutes of CPU time before being dispatched to the application. The impact of this vulnerability is a DoS condition, causing service disruption and potential unavailability.

How To Fix

Latest published version: 12.1.14 as of 23 Oct 2026

Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.

If you can't move to the latest

The minimum fixed version depends on the release line you run.

>= 9.4.6, < 9.4.37 9.4.37
>= 10.0.0, < 10.0.1 10.0.1
>= 11.0.0, < 11.0.1 11.0.1

Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →

Workaround

If updating the package is not immediately feasible, the following workarounds can be implemented:

Avoid using the default error page/handler.
Do not deploy the StatisticsServlet exposed to the network.
Avoid calling the getLocale API.
Disable precompressed static content in the DefaultServlet.

Conclusion

The org.eclipse.jetty:jetty-server package is vulnerable to a denial of service (DoS) condition due to a flaw in handling request headers with a large number of 'quality' parameters. This vulnerability can lead to service disruption and unavailability. It is crucial to update the package to the patched versions or implement the provided workarounds to mitigate the risk. For further support on vulnerability remediation, please contact DevNack.com.

See every vulnerability recorded for org.eclipse.jetty:jetty-server →

FAQ

What is the impact of this vulnerability?

The vulnerability can lead to a denial of service (DoS) condition, causing high CPU usage and potentially consuming significant amounts of CPU time. This can result in service disruption and unavailability.

Which versions of org.eclipse.jetty:jetty-server are affected?

The affected versions include 9.4.6.v20170531 to 9.4.36.v20210114, 10.0.0, and 11.0.0.

How can I mitigate this vulnerability?

To mitigate this vulnerability, it is recommended to update the org.eclipse.jetty:jetty-server package to the patched versions: 9.4.37.v20210219 or higher, 10.0.1 or higher, or 11.0.1 or higher.

Are there any workarounds available?

Yes, if immediate package update is not possible, you can implement the provided workarounds, such as avoiding the default error page/handler, not deploying the StatisticsServlet exposed to the network, avoiding the getLocale API, and disabling precompressed static content in the DefaultServlet.