UpHeron
All vulnerabilities

Servers and applications

CVE-2023-40167

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request…

Severity
Medium 5.3
Published
15 Sept 2023
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
9.4.52, 10.0.16, 11.0.16
Sources
NVD

Affected software

SoftwareAffected versions
Eclipse JettyServers and applications · cpe:a:eclipse:jetty
  • Version 12.0.0
  • Version 12.0.0-beta4
  • Version 12.0.0-beta3
  • Version 12.0.0-beta2
All 9 release lines
  • From 9.0.0 before 9.4.52
  • From 10.0.0 before 10.0.16
  • From 11.0.0 before 11.0.16
  • Version 12.0.0-beta0
  • Version 12.0.0-beta1
  • Version 12.0.0-beta2
  • Version 12.0.0-beta3
  • Version 12.0.0-beta4
  • Version 12.0.0

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2023-40167
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2023-40167