VYPR
← All advisories
Moderate severityNVD Advisory· Published Feb 26, 2021· Updated Aug 20, 2025

CVE-2020-27223

CVE-2020-27223

Description

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Eclipse Jetty 9.4.6–9.4.36, 10.0.0, and 11.0.0 are vulnerable to a denial-of-service (DoS) via crafted Accept headers with many quality parameters, exhausting CPU for minutes.

Vulnerability

Description

CVE-2020-27223 is a denial-of-service (DoS) vulnerability in Eclipse Jetty, a popular Java-based web server and servlet engine. The flaw resides in the QuotedQualityCSV parser, which processes HTTP request headers such as Accept, Accept-Encoding, and Accept-Language. When a request contains multiple Accept headers with a large number of “quality” (q) parameters, the server spends excessive CPU time sorting and processing those values, potentially consuming minutes of CPU time before the request is even dispatched to the application [1][2].

Exploitation

An attacker can exploit this vulnerability by sending a single HTTP request with crafted Accept headers containing many quality parameters. No authentication is required, and the attack can be launched remotely over the network. The vulnerable code is triggered by several Jetty features: default error handling (which uses the Accept header to determine response content type), the StatisticsServlet, calls to HttpServletRequest.getLocale() or getLocales(), and pre-compressed static content handling in the DefaultServlet [4].

Impact

Successful exploitation leads to a denial-of-service condition where the Jetty server becomes unresponsive for an extended period due to high CPU usage. This can disrupt service availability for legitimate users. The CVSS v3.1 base score is 5.3 (Moderate) with a vector of AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L, indicating low impact on availability but no impact on confidentiality or integrity [2].

Mitigation

Patches are available for all affected versions. Users should upgrade to Jetty 9.4.37.v20210210 or later, or to the fixed releases for 10.x and 11.x lines. As a workaround, administrators can avoid using the default error page/handler, not deploy the StatisticsServlet exposed to the network, avoid calling getLocale API, and disable pre-compressed static content in the DefaultServlet. Additionally, a rewrite rule can be deployed to limit the number and size of Accept-* headers [2][4].

References
  1. NVD - CVE-2020-27223
  2. 571128 – (CVE-2020-27223) Jetty DOS vulnerability for Quoted Quality CSV headers
  3. DOS vulnerability for Quoted Quality CSV headers

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.eclipse.jetty:jetty-serverMaven
>= 9.4.6, < 9.4.379.4.37
org.eclipse.jetty:jetty-serverMaven
>= 10.0.0, < 10.0.110.0.1
org.eclipse.jetty:jetty-serverMaven
>= 11.0.0, < 11.0.111.0.1

Affected products

6

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

130

News mentions

0

No linked articles in our index yet.