CVE-2017-7656: The Eclipse Foundation Eclipse Jetty vulnerability…

CVE-2017-7656: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuratio...

In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), HTTP/0.9 is handled poorly. An HTTP/1 style request line (i.e. method space URI space version) that declares a version of HTTP/0.9 was accepted and treated as a 0.9 request. If deployed behind an intermediary that also accepted and passed through the 0.9 version (but did not act on it), then the response sent could be interpreted by the intermediary as HTTP/1 headers. This could be used to poison the cache if the server allowed the origin client to generate arbitrary content in the response.

UnknownCVSS not scoredNot KEV-listedUpdatedAug 5, 2024, 16:12 UTC (UTC+00:00)

Security readout for executives and security teams

Plain-English summary

CVE-2017-7656 is a Jetty HTTP parsing flaw that can let a specially formed legacy HTTP/0.9 request confuse an upstream cache or proxy. The business risk is cache poisoning: users may receive attacker-influenced content if exposed Jetty services sit behind permissive intermediaries and allow user-controlled response content.

Executive priority

Treat as a targeted hygiene issue, not an emergency based on the available evidence. Prioritize externally exposed Jetty services behind caching layers because successful abuse could affect many users through poisoned cached responses.

Technical view

Affected Jetty versions may accept an HTTP/1-style request line declaring HTTP/0.9 and treat it as HTTP/0.9. If an intermediary passes that request through but interprets Jetty's response as HTTP/1 headers, cache poisoning can result. This is classified as CWE-444, inconsistent HTTP interpretation.

Likely exposure

Most relevant to internet-facing or partner-facing Jetty deployments behind caching proxies, CDNs, reverse proxies, or gateways. Exposure is narrower for Jetty 9.4 because the source notes a non-default RFC2616 compliance configuration.

Exploitation context

The provided sources do not show CISA KEV listing or active exploitation. Exploitation depends on a compatible intermediary behavior and an application path where the origin client can influence response content. Evidence for real-world abuse is incomplete in the bundle.

Researcher notes

Focus analysis on request-version normalization differences between Jetty and intermediaries. The vulnerable condition is not Jetty alone; it requires permissive intermediary behavior and response content control. The bundle does not provide CVSS, exact fixed versions, or exploit telemetry.

Mitigation direction

Inventory Jetty versions and identify 9.2.x or older, 9.3.x, and affected 9.4.x deployments.
Check Eclipse Jetty and downstream vendor advisories for supported fixed versions.
Avoid non-default RFC2616 compliance behavior in Jetty 9.4 unless vendor guidance confirms safety.
Configure proxies, caches, and gateways to reject legacy HTTP/0.9 request handling.
Review cacheable endpoints that reflect or serve user-controlled content.

Validation and detection

Confirm whether Jetty is deployed behind any cache, CDN, proxy, or gateway.
Review Jetty configuration for RFC2616 compliance settings in 9.4.x deployments.
Check dependency manifests and runtime packages for affected Jetty versions.
Verify intermediary policy rejects unsupported or legacy HTTP versions.
Confirm vendor advisory remediation has been applied in upstream products embedding Jetty.

Prepared: Jun 7, 2026, 06:24 UTC (UTC+00:00)
Confidence: medium
Sources: 6

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-444: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup

cve · low confidence lookup

CVE-2017-7656 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup

Vulnerability profileCVE Program record

Severity: Unknown
CVSS: Not scored
Known Exploited: No
Published: Jun 26, 2018, 15:00 UTC (UTC+00:00)

Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors

0Timeline events

0ADP providers

12Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

CVE List V5 sourceCVE List V5
DSA-4278CVE reference · vendor-advisory, x_refsource_DEBIAN
[lucene-solr-user] 20190104 Re: SOLR v7 Security Issues Caused Denial of Use - Sonatype Application Composition ReportCVE reference · mailing-list, x_refsource_MLIST
[activemq-issues] 20190820 [jira] [Created] (AMQ-7279) Security Vulnerabilities in Libraries - jackson-databind-2.9.8.jar, tomcat-servlet-api-8.0.53.jar, tomcat-websocket-api-8.0.53.jar, zookeeper-3.4.6.jar, guava-18.0.jar, jetty-all-9.2.26.v20180806.jar, scala-library-2.11.0.jarCVE reference · mailing-list, x_refsource_MLIST
[druid-commits] 20191115 [GitHub] [incubator-druid] ccaominh opened a new pull request #8878: Address security vulnerabilitiesCVE reference · mailing-list, x_refsource_MLIST
https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlCVE reference · x_refsource_MISC
[maven-issues] 20200730 [GitHub] [maven-dependency-plugin] slachiewicz commented on pull request #91: Bump jettyVersion from 9.2.28.v20190418 to 9.3.0.v20150612CVE reference · mailing-list, x_refsource_MLIST
https://www.oracle.com/security-alerts/cpuoct2020.htmlCVE reference · x_refsource_MISC
https://bugs.eclipse.org/bugs/show_bug.cgi?id=535667CVE reference · x_refsource_CONFIRM
https://security.netapp.com/advisory/ntap-20181014-0001/CVE reference · x_refsource_CONFIRM
https://support.hpe.com/hpsc/doc/public/display?docLocale=en_US&docId=emr_na-hpesbst03953en_usCVE reference · x_refsource_CONFIRM
https://www.oracle.com//security-alerts/cpujul2021.htmlCVE reference · x_refsource_MISC

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus

The Eclipse FoundationEclipse Jettyunspecified, 9.3.0, unspecified, 9.4.0, unspecifiedListed

Weakness

CWE details

CWE-444

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-444 · source CWE mapping

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligence Same-CWE CVEs