# CVE-2023-36478: jetty9: Eclipse Jetty provides a web server and servlet container

CVE-2023-36478 is fixed in jetty9 on 1 platform, first by DEBIAN-CVE-2023-36478, released October 10, 2023. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2023-36478
- Priority: High
- CVSS: 7.5 (high)
- EPSS: 0.0483
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Oct 10, 2023

## Description

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Linux | jetty9 Debian 11.6 (bullseye) | 9.4.50-4+deb11u1 | [DSA-5540-1](https://patchblox.com/security/data/fix/linux/dsa-5540-1.md) | Oct 30, 2023 |
| Linux | jetty9 Debian 12.15 (bookworm) | 9.4.50-4+deb12u2 | [DSA-5540-1](https://patchblox.com/security/data/fix/linux/dsa-5540-1.md) | Oct 30, 2023 |
| Linux | jetty9 Debian 13.5 (trixie) | 9.4.53-1 | [DEBIAN-CVE-2023-36478](https://patchblox.com/security/data/fix/linux/debian-cve-2023-36478.md) | Oct 10, 2023 |
| Linux | jetty9 Debian 14 | 9.4.53-1 | [DEBIAN-CVE-2023-36478](https://patchblox.com/security/data/fix/linux/debian-cve-2023-36478.md) | Oct 10, 2023 |

---

Data as of 2026-11-09T07:25:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo

Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data

Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.