In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept

Summary

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.

Timeline

1. Feb 26, 2021, 9:55 PM UTCCVE published
2. Aug 20, 2025, 10:03 AM UTCRecord last updated
3. Oct 28, 2026EPSS reached 10%

   FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

• The Eclipse Foundation Eclipse Jetty

  From 9.4.6.v20170531; through 9.4.36.v20210114

• org.eclipse.jetty:jetty-serverMaven

  From 9.4.6 · fixed in 9.4.37

• org.eclipse.jetty:jetty-serverMaven

  From 10.0.0 · fixed in 10.0.1

• org.eclipse.jetty:jetty-serverMaven

  From 11.0.0 · fixed in 11.0.1

References 27