CVE-2017-7658 Eclipse Jetty
| Affected software | Eclipse Jetty |
|---|---|
| Severity | 9.8 Critical CVSS 3.1 2 scores |
| Fixed in | 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605 |
| Weakness | CWE-444 |
| Published | 26 Jun 2018 |
| Updated | 17 Jun 2026 |
Description
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.
Exploitation status
No public exploit
No exploit has been reported in the sources we check. Published 8 years ago.
Exploitation status
- CISA KEV not listed
- VulnCheck KEV not listed
- CISA Vulnrichment no assessment published
- Indexed PoC none indexed
- EPSS 19% chance in 30 days A model's forecast, not a report of exploitation. Higher than 97% of all scored CVEs.
Waratek protection
Within Waratek scope. In the sources we check, nobody has published exploit code for this CVE or reported it being exploited.
VRT has not found a public code change for this CVE yet.
- Protection none
- Action not pursued
- Review human Researcher
- Record active
| Decided by | Manual classification of this CVE in the legacy dataset |
|---|---|
| Finding | A manual classification set this CVE's status to No source fix or exploit. |
CVSS
9.8 CRITICAL
v3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
CVSS
9.8 CRITICAL v3.1CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
2 metrics
We show the highest score from the newest CVSS version. Scores from different versions can't be compared, and the first score listed is sometimes a 0.0 placeholder.
| Version | Score | Band | Vector | Assigner | Type | |
|---|---|---|---|---|---|---|
| CVSS 3.1 | 9.8 | CRITICAL | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
NVD | Primary | published |
| CVSS 2.0 | 7.5 | none | AV:N/AC:L/Au:N/C:P/I:P/A:P |
NVD | Primary |
Affected software and releases
Oracle advisories
| Advisory | Type | Quarter | Products Oracle names in its risk matrix |
|---|---|---|---|
| Oracle Critical Patch Update October 2020 ↗ | CPU | 2020-Q4 | Oracle REST Data Services / General (Eclipse Jetty) (11.2.0.4, 12.1.0.2, 12.2.0.1, 18c) |
| Oracle Critical Patch Update January 2019 ↗ | CPU | 2019-Q1 | Oracle Retail Applications / Security (Jetty) (3.3) |
Oracle components and versions
| Family | Component | Versions, as Oracle lists them | Read as |
|---|---|---|---|
| Oracle REST Data Services | General (Eclipse Jetty) | 11.2.0.4, 12.1.0.2, 12.2.0.1, 18c | 11.2.0.4 · 12.1.0.2 · 12.2.0.1 · 18 |
| Oracle Retail Applications | Security (Jetty) | 3.3 | 3.3 |
Maven packages
Affected and fixed versions, from OSV.dev| Package | Introduced | Fixed | Last affected |
|---|---|---|---|
org.eclipse.jetty:jetty-server |
0 | 9.2.25.v20180606 |
unbounded |
org.eclipse.jetty:jetty-server |
9.3.0 | 9.3.24.v20180605 |
unbounded |
org.eclipse.jetty:jetty-server |
9.4.0 | 9.4.11.v20180605 |
unbounded |
Products and versions
20 products, 30 version entries| Source | Vendor | Product | Scheme | Affected versions |
|---|---|---|---|---|
| nvd | debian | debian linux | generic | 9.0 |
| nvd | eclipse | jetty | generic | ≤ 9.2.26 · ≥ 9.3.0 and ＜ 9.3.24 · ≥ 9.4.0 and ＜ 9.4.11 |
| nvd | hp | xp p9000 command view | generic | ≥ 8.4.0.0 and ≤ 8.6.2.0 |
| nvd | netapp | e-series santricity management | generic | any version |
| nvd | netapp | e-series santricity os controller | generic | ≥ 11.0 and ≤ 11.50.1 |
| nvd | netapp | e-series santricity web services | generic | any version |
| nvd | netapp | hci management node | generic | any version |
| nvd | netapp | hci storage node | generic | any version |
| nvd | netapp | oncommand system manager | generic | ≥ 3.0 and ≤ 3.1.3 |
| nvd | netapp | oncommand unified manager for 7-mode | generic | any version |
| nvd | netapp | santricity cloud connector | generic | any version |
| nvd | netapp | snap creator framework | generic | any version |
| nvd | netapp | snapcenter | generic | any version |
| nvd | netapp | snapmanager | generic | any version |
| nvd | netapp | solidfire | generic | any version |
| nvd | netapp | storage services connector | generic | any version |
| nvd | oracle | rest data services | generic | 11.2.0.4 · 12.1.0.2 · 12.2.0.1 · 18c |
| nvd | oracle | retail xstore payment | generic | 3.3 |
| nvd | oracle | retail xstore point of service | generic | 7.1 · 15.0 · 16.0 · 17.0 |
| osv | org.eclipse.jetty | jetty-server | generic | ＜ 9.2.25.99999 · ≥ 9.3.0 and ＜ 9.3.24.99999 · ≥ 9.4.0 and ＜ 9.4.11.99999 |
Earlier manual review
A reviewer classified this CVE in an older dataset. We kept the labels and products below, but not the reviewer's reasoning.
## Manual Classification Context **Labels:** SECURITY (JETTY), HTTP, GENERAL (ECLIPSE JETTY), NO AUTH REMOTE EXPLOIT **Products:** ORACLE RETAIL APPLICATIONS, JETTY, ORACLE REST DATA SERVICES, ORACLE RETAIL XSTORE PAYMENT
References
Timeline
Timeline
| Published | 2018-06-26 | By the CVE Program. |
|---|---|---|
| NVD record modified | 2026-06-17 | NVD's own last-modified date for this record. |