CVE-2019-17638In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to…
- 9.4CriticalCVSS base score
- 11.1%Exploitation in 30 daysEPSS · top 4.0% of all CVEs
- NoKnown exploitednot in CISA's KEV catalog
- NonePublic exploitsnone known yet
Description
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to use the ByteBuffer to write response1 data, thread2 fills the ByteBuffer with other data. Thread1 then proceeds to write the buffer that now contains different data. This results in client1, which issued request1 seeing data from another request or response which could contain sensitive data belonging to client2 (HTTP session ids, authentication credentials, etc.). If the Jetty version cannot be upgraded, the vulnerability can be significantly reduced by configuring a responseHeaderSize significantly larger than the requestHeaderSize (12KB responseHeaderSize and 8KB requestHeaderSize).
Timeline
ID reserved
By eclipse
- 9 months later
· 9 months later
Published
- 4 years later
· 4 years later
Record updated
Changes after publication (a new score, a public exploit, EPSS crossing 1, 10 or 50 %, leaving KEV) are kept since November 2026; earlier ones are not known.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 3.1 | Critical9.4 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L |
- EPSS (exploitation in 30 days)
- 11.1% · top 4.0% of all CVEs (12 Nov 2026)
The list uses the assigner's score when there is one, then CISA's, then NVD's: Critical 9.4.
Affected products
The Eclipse Foundation · Eclipse Jetty
- affected 9.4.27.v20200227 to 9.4.29.v20200521
Affected packages
From reviewed advisories of the GitHub Advisory Database.
- Mavenorg.eclipse.jetty:jetty-serverGHSA-x3rh-m7vp-35f2 (opens in a new tab)
References
References17
- https://bugs.eclipse.org/bugs/show_bug.cgi?id=564984 (opens in a new tab)x_refsource_CONFIRMx_transferred
- [oss-security] 20200817 Vulnerability in Jenkins (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- FEDORA-2020-cf8ef2f333 (opens in a new tab)vendor-advisoryx_refsource_FEDORAx_transferred
- [pulsar-commits] 20200903 [GitHub] [pulsar] guyv opened a new issue #7970: pulsar-client vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20200911 [GitHub] [pulsar] codelipenghui closed issue #7970: pulsar-client vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20200912 [GitHub] [pulsar] codelipenghui closed issue #7970: pulsar-client vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20200914 [GitHub] [pulsar] klwilson227 opened a new issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20200922 [GitHub] [pulsar] zymap commented on issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20200923 [GitHub] [pulsar] zymap commented on issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20200929 [GitHub] [pulsar] sijie closed issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20200929 [GitHub] [pulsar] sijie commented on issue #8060: CVE-2019-17638 jetty server (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20201005 [GitHub] [pulsar] abhishekheaven7 opened a new issue #8203: Pulsar client with version 2.6.1 has critical vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20201005 [GitHub] [pulsar] abhishekheaven7 closed issue #8203: Pulsar client with version 2.6.1 has critical vulnerability CVE-2019-17638 (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://www.oracle.com/security-alerts/cpuoct2020.html (opens in a new tab)x_refsource_MISCx_transferred
- [pulsar-commits] 20201215 [GitHub] [pulsar] yanshuchong opened a new issue #8967: CVSS issue list (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- [pulsar-commits] 20210127 [GitHub] [pulsar] GLouMcK opened a new issue #9347: Security Vulnerabilities - Black Duck Scan (opens in a new tab)mailing-listx_refsource_MLISTx_transferred
- https://www.oracle.com/security-alerts/cpuApr2021.html (opens in a new tab)x_refsource_MISCx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- EUVD EUVD-2020-0652 (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisory GHSA-x3rh-m7vp-35f2 (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://cveledger.app/cve/CVE-2019-17638)Record last updated .