{
  "cveId": "CVE-2023-36478",
  "url": "https://patchblox.com/security/cve/CVE-2023-36478",
  "summary": "CVE-2023-36478 is fixed in jetty9 on 1 platform, first by DEBIAN-CVE-2023-36478, released October 10, 2023. It is not reported as exploited. Patch Radar priority: High.",
  "title": "jetty9: Eclipse Jetty provides a web server and servlet container",
  "description": "Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in \u0060MetaDataBuilder.checkSize\u0060 allows for HTTP/2 HPACK header values to exceed their size limit. \u0060MetaDataBuilder.java\u0060 determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. \u0060(_size\u002Blength)\u0060 will now be negative, and the check on line 296 will not be triggered. Furthermore, \u0060MetaDataBuilder.checkSize\u0060 allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.",
  "published": "2023-10-10T17:15:11Z",
  "severity": "high",
  "cvss": 7.5,
  "cvssVector": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H",
  "epss": 0.04832,
  "epssPercentile": 0.92052,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "jetty9",
      "release": "Debian 11.6 (bullseye)",
      "fixedVersion": "9.4.50-4\u002Bdeb11u1",
      "fix": "DSA-5540-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5540-1",
      "released": "2023-10-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "jetty9",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "9.4.50-4\u002Bdeb12u2",
      "fix": "DSA-5540-1",
      "url": "https://patchblox.com/security/fix/linux/dsa-5540-1",
      "released": "2023-10-30T00:00:00Z"
    },
    {
      "platform": "linux",
      "product": "jetty9",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "9.4.53-1",
      "fix": "DEBIAN-CVE-2023-36478",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-36478",
      "released": "2023-10-10T17:15:11Z"
    },
    {
      "platform": "linux",
      "product": "jetty9",
      "release": "Debian 14",
      "fixedVersion": "9.4.53-1",
      "fix": "DEBIAN-CVE-2023-36478",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2023-36478",
      "released": "2023-10-10T17:15:11Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-09T07:25:28Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}