UpHeron
All vulnerabilities

Servers and applications

CVE-2019-17638

In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty throws an exception to produce an HTTP 431 error. When this happens, the ByteBuffer containing the HTTP response headers is released back to the ByteBufferPool twice. Because of this double release, two threads can acquire the same ByteBuffer from the pool and while thread1 is about to…

Severity
Critical 9.4
Published
9 Jul 2020
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Eclipse JettyServers and applications · cpe:a:eclipse:jetty
  • Version 9.4.27-20200227
  • Version 9.4.28-20200408
  • Version 9.4.29-20200521

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2019-17638
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2019-17638