Vulnerability record · CVE-2017-7657 · published 26 June 2018
CVE-2017-7657: Eclipse jetty http request smuggling vulnerability
Eclipse · Jetty
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Description
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Affected products
17 vulnerable configurations from NVD's CPE data, grouped by vendor and product.
Debian Linux Debian
Jetty Eclipse
Xp P9000 Command View Hp
NE Series Santricity Management Netapp
NE Series Santricity Os Controller Netapp
NE Series Santricity Web Services Netapp
NElement Software Netapp
NElement Software Management Node Netapp
NHci Storage Nodes Netapp
NOncommand System Manager Netapp
NOncommand Unified Manager Netapp
NSantricity Cloud Connector Netapp
NSnap Creator Framework Netapp
NSnapcenter Netapp
NSnapmanager Netapp
Rest Data Services Oracle
Retail Xstore Point Of Service Oracle
References
Track CVE-2017-7657 inside VULONE
Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.
Related vulnerabilities
Same products first, then exploited flaws of the same weakness class.
Source: NIST National Vulnerability Database (record CVE-2017-7657), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.
