Medium severity4.8NVD Advisory· Published Nov 28, 2020· Updated Jun 17, 2026

CVE-2020-27218

Description

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.eclipse.jetty:jetty-serverMaven	>= 9.4.0, < 9.4.35.v20201120	9.4.35.v20201120

Affected products

osv-coords6 versions
pkg:rpm/suse/jetty-minimal&distro=SUSE%20Linux%20Enterprise%20Module%20for%20Development%20Tools%2015%20SP2 pkg:maven/org.eclipse.jetty/jetty-server pkg:bitnami/spark pkg:bitnami/kafka pkg:rpm/opensuse/jetty-minimal&distro=openSUSE%20Leap%2015.2 pkg:rpm/opensuse/jetty-websocket&distro=openSUSE%20Leap%2015.2
< 9.4.35-3.3.4+ 5 more
- (no CPE)range: < 9.4.35-3.3.4
- (no CPE)range: >= 9.4.0, < 9.4.35.v20201120
- (no CPE)range: >= 2.4.8, < 2.4.9
- (no CPE)range: >= 2.7.0, < 2.7.1
- (no CPE)range: < 9.4.35-lp152.2.3.1
- (no CPE)range: < 9.4.35-lp152.2.3.1
Eclipse/Jetty10 versions
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*+ 9 more
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*range: >=9.4.0,<9.4.35
- cpe:2.3:a:eclipse:jetty:10.0.0:alpha0:*:*:*:*:*:*
- cpe:2.3:a:eclipse:jetty:10.0.0:alpha1:*:*:*:*:*:*
- cpe:2.3:a:eclipse:jetty:10.0.0:beta0:*:*:*:*:*:*
- cpe:2.3:a:eclipse:jetty:10.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:eclipse:jetty:10.0.0:beta2:*:*:*:*:*:*
- cpe:2.3:a:eclipse:jetty:11.0.0:alpha0:*:*:*:*:*:*
- cpe:2.3:a:eclipse:jetty:11.0.0:beta1:*:*:*:*:*:*
- cpe:2.3:a:eclipse:jetty:11.0.0:beta2:*:*:*:*:*:*
- (no CPE)range: 9.4.0.RC0 to 9.4.34.v20201102
NetApp/Oncommand System Manager
cpe:2.3:a:netapp:oncommand_system_manager:*:*:*:*:*:*:*:*
Range: >=3.0,<=3.1.3
NetApp/Snap Creator Framework
cpe:2.3:a:netapp:snap_creator_framework:-:*:*:*:*:*:*:*
Oracle Corporation/Blockchain Platform
cpe:2.3:a:oracle:blockchain_platform:*:*:*:*:*:*:*:*
Range: <21.1.2
Oracle Corporation/Communications Converged Application Server Service Controller
cpe:2.3:a:oracle:communications_converged_application_server_-_service_controller:6.2:*:*:*:*:*:*:*
Oracle Corporation/Communications Offline Mediation Controller
cpe:2.3:a:oracle:communications_offline_mediation_controller:12.0.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Pricing Design Center
cpe:2.3:a:oracle:communications_pricing_design_center:12.0.0.3.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Services Gatekeeper
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
Oracle Corporation/Communications Session Route Manager
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*
Range: >=8.0.0,<=8.2.4
Oracle Corporation/Flexcube Private Banking2 versions
cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:oracle:flexcube_private_banking:12.0.0:*:*:*:*:*:*:*
- cpe:2.3:a:oracle:flexcube_private_banking:12.1.0:*:*:*:*:*:*:*
Oracle Corporation/Hyperion Infrastructure Technology
cpe:2.3:a:oracle:hyperion_infrastructure_technology:11.1.2.6.0:*:*:*:*:*:*:*
Oracle Corporation/REST Data Services
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:-:*:*:*
Range: <20.4.3.050.1904
Oracle Corporation/Retail Eftlink
cpe:2.3:a:oracle:retail_eftlink:20.0.0:*:*:*:*:*:*:*
Oracle Corporation/Siebel Core Automation
cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:*
Range: <=21.5
Apache/Kafka
cpe:2.3:a:apache:kafka:2.7.0:*:*:*:*:*:*:*
Apache/Spark2 versions
cpe:2.3:a:apache:spark:2.4.8:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:apache:spark:2.4.8:*:*:*:*:*:*:*
- cpe:2.3:a:apache:spark:3.0.3:*:*:*:*:*:*:*
Debian/linux
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*

cvss	0.312
epss	0.006
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000

CVE-2020-27218

Description

AI Insight

Affected packages

Affected products

Patches

Vulnerability mechanics

References

News mentions