CVE-2023-36478
📋 TL;DR
This CVE describes an integer overflow vulnerability in Eclipse Jetty's HTTP/2 HPACK header processing. Attackers can send specially crafted HTTP/2 requests with large header values that bypass size limits, causing excessive memory allocation and leading to denial of service. Users running vulnerable Jetty versions with HTTP/2 enabled are affected.
💻 Affected Systems
- Eclipse Jetty
📦 What is this software?
Jenkins by Jenkins
Jenkins by Jenkins
Jetty by Eclipse
Jetty by Eclipse
Jetty by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Remote attacker causes memory exhaustion leading to complete service unavailability and potential system instability.
Likely Case
Denial of service through memory exhaustion, causing service disruption and degraded performance.
If Mitigated
With proper network controls and monitoring, impact is limited to temporary service degradation.
🎯 Exploit Status
Exploitation requires HTTP/2 access but no authentication. The vulnerability is straightforward to exploit once understood.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jetty 9.4.53, 10.0.16, 11.0.16
Vendor Advisory: https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009
Restart Required: Yes
Instructions:
1. Download patched version from Eclipse Jetty releases. 2. Stop Jetty service. 3. Replace Jetty JARs with patched versions. 4. Restart Jetty service. 5. Verify version update.
🔧 Temporary Workarounds
Disable HTTP/2
allDisable HTTP/2 protocol support to prevent exploitation
Configure Jetty connector to use HTTP/1.1 only
🧯 If You Can't Patch
- Implement network controls to restrict HTTP/2 traffic to trusted sources only
- Monitor memory usage and implement alerting for abnormal memory consumption patterns
🔍 How to Verify
Check if Vulnerable:
Check Jetty version and HTTP/2 configuration. If running affected versions with HTTP/2 enabled, system is vulnerable.Check Version:
java -jar jetty-home-*.jar --versionVerify Fix Applied:
Verify Jetty version is 9.4.53+, 10.0.16+, or 11.0.16+ and test HTTP/2 functionality.📡 Detection & Monitoring
Log Indicators:
- Memory allocation errors
- OutOfMemoryError exceptions
- HTTP/2 connection resets
Network Indicators:
- Unusually large HTTP/2 header frames
- Multiple HTTP/2 connections with large payloads
SIEM Query:
source="jetty.log" AND ("OutOfMemoryError" OR "Memory allocation failed" OR "HTTP/2 header size")🔗 References
- http://www.openwall.com/lists/oss-security/2023/10/18/4
- https://github.com/eclipse/jetty.project/pull/9634
- https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16
- https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16
- https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r
- https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html
- https://security.netapp.com/advisory/ntap-20231116-0011/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.debian.org/security/2023/dsa-5540
- http://www.openwall.com/lists/oss-security/2023/10/18/4
- https://github.com/eclipse/jetty.project/pull/9634
- https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16
- https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16
- https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.53.v20231009
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgh7-54f2-x98r
- https://lists.debian.org/debian-lts-announce/2023/10/msg00045.html
- https://security.netapp.com/advisory/ntap-20231116-0011/
- https://security.netapp.com/advisory/ntap-20240621-0006/
- https://www.debian.org/security/2023/dsa-5540
