CVE-2023-40167

Deeper analysis

Jetty, an open-source Java web server and servlet container, is affected by a parsing inconsistency in its HTTP/1 handling prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1. The server accepts a leading “+” character in the Content-Length header value, which deviates from RFC 9110 requirements and from the stricter behavior of many other HTTP implementations that respond with a 400 status.

An unauthenticated network attacker could send such a malformed request in an attempt to trigger request-smuggling conditions when Jetty is placed behind or in front of another server that fails to close the connection after issuing a 400 response. Although no concrete exploit scenario has been identified, the permissive parsing could allow an attacker to manipulate request framing and potentially reach protected resources or bypass access controls in certain proxy or load-balanced deployments.

The project’s security advisory and downstream distributions such as Debian advise immediate upgrade to the patched releases; no configuration workaround exists. Public references, including the GitHub advisory GHSA-hmr7-m48g-48f6 and the associated RFC section, document the discrepancy and the fix.

EPSS scores have remained low, with a current value of 0.0457 and a peak of only 0.0553, indicating limited observed exploitation interest since disclosure.