VYPR
← All advisories
Moderate severityNVD Advisory· Published Nov 28, 2020· Updated Aug 4, 2024

CVE-2020-27218

CVE-2020-27218

Description

In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Eclipse Jetty fails to correctly recycle HTTP input when GZIP body inflation is enabled, allowing an attacker to inject data into a subsequent multiplexed request.

Vulnerability

Description

A vulnerability exists in Eclipse Jetty 9.4.0.RC0 through 9.4.34.v20201102, 10.0.0.alpha0 through 10.0.0.beta2, and 11.0.0.alpha0 through 11.0.0.beta2. When GZIP request body inflation is enabled and multiple client requests are multiplexed onto a single connection, if an attacker sends a request with a body that is fully received but not consumed by the application, Jetty fails to properly recycle the HTTP input buffer. As a result, the unconsumed data is prepended to the body of the next request on the same connection [1][2].

Exploitation

Conditions

The attack requires a network position that allows multiplexing requests onto the same connection (e.g., HTTP/2 or HTTP/1.1 with keep-alive). The attacker must send a request whose GZIP-decompressed body is entirely received by the server but not read by the application handler. The vulnerability has a CVSS 4.0 score of 4.8 (AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:L), indicating high complexity but no authentication needed, and a low impact on integrity and availability [2][4].

Impact

An attacker cannot see any data from other requests, but can inject arbitrary content into the body of a subsequent victim request on the same connection. This could lead to request smuggling or manipulation of application logic if the service relies on the request body for critical decisions (e.g., form parameters, API JSON payloads).

Mitigation

Patched versions include Jetty 9.4.33.v20201020, 10.0.0.beta3, and 11.0.0.beta3. Workarounds include disabling GZIP request body inflation via GzipHandler, ensuring application code fully consumes request content before sending a response, or adding a Connection: close header to responses when content is not fully consumed [2][4].

References
  1. NVD - CVE-2020-27218
  2. 568892 – (CVE-2020-27218) Jetty HttpInput not correctly recycled
  3. Buffer not correctly recycled in Gzip Request inflation

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.eclipse.jetty:jetty-serverMaven
>= 9.4.0, < 9.4.35.v202011209.4.35.v20201120

Affected products

5

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

229

News mentions

0

No linked articles in our index yet.