OutOfMemoryError for large multipart without filename in Eclipse Jetty

Vulnerability

CVE-2023-26048 is a denial-of-service vulnerability in Eclipse Jetty, affecting servlets configured for multipart processing (e.g., annotated with @MultipartConfig). When HttpServletRequest.getParameter() or HttpServletRequest.getParts() is invoked on a multipart request containing a part that has a name but no filename and a very large content, Jetty may throw an OutOfMemoryError. This occurs even when the default fileSizeThreshold=0 is set, which should normally cause the entire part content to be streamed to disk rather than held in memory [1].

Exploitation

An attacker can exploit this by sending a crafted multipart request with one part that satisfies the name/no-filename condition and carries an extremely large payload. No authentication is required; the issue can be triggered remotely through a standard HTTP request to any vulnerable endpoint with multipart handling enabled [1]. The server may eventually recover after the OutOfMemoryError, but service disruption and degraded performance will occur during the recovery period.

Impact

The primary impact is denial of service (DoS) – the JVM's heap is exhausted, leading to an OutOfMemoryError. Although the server can continue after recovery, the attack consumes resources and can cause temporary unavailability of the affected application [1].

Mitigation

Patches are available in Jetty versions 9.4.51, 10.0.14, and 11.0.14 [1]. Users unable to upgrade immediately can mitigate the issue by setting the multipart parameter maxRequestSize to a non-negative value, which limits the total size of the multipart content (though it remains read into memory) [1].