LiveActive security incident?Get immediate response
CVE Record

CVE-2017-7658: In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all...

In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTTP/1.x configurations), when presented with two content-lengths headers, Jetty ignored the second. When presented with a content-length and a chunked encoding header, the content-length was ignored (as per RFC 2616). If an intermediary decided on the shorter length, but still passed on the longer body, then body content could be interpreted by Jetty as a pipelined request. If the intermediary was imposing authorization, the fake pipelined request would bypass that authorization.

UnknownCVSS not scoredNot KEV-listedUpdated
Discuss exposureBack to CVEs
Glexia's TakeAutomated analysishigh

Security readout for executives and security teams

Plain-English summary

CVE-2017-7658 is an HTTP request parsing issue in Eclipse Jetty. Under specific proxy or intermediary conditions, a crafted request body could be treated by Jetty as a second request, potentially bypassing authorization enforced before Jetty.

Executive priority

Treat as high priority where affected Jetty is reachable through proxies or gateways that make access-control decisions. The issue can turn infrastructure parsing differences into authorization bypass risk, but the bundle does not show active exploitation.

Technical view

Affected Jetty versions mishandled ambiguous HTTP framing involving duplicate Content-Length headers or Content-Length with chunked transfer encoding. If an intermediary and Jetty disagreed about request length, remaining body content could be interpreted as a pipelined request. This maps to CWE-444 request smuggling behavior.

Likely exposure

Exposure is most relevant for services running affected Jetty versions behind reverse proxies, gateways, load balancers, or other intermediaries that enforce authorization or route requests before Jetty. The bundle does not prove exposure for every downstream product reference.

Exploitation context

The provided bundle marks KEV as false and contains no cited evidence of active exploitation. The risk depends on intermediary behavior and whether Jetty receives ambiguous HTTP request framing through trusted front-end infrastructure.

Researcher notes

Key unknowns are exact fixed versions, deployment topology, and intermediary parsing behavior. Validate exposure by correlating Jetty versions with front-end HTTP infrastructure. Avoid assuming downstream Apache or Oracle references mean exploitable instances without product-specific confirmation.

Mitigation direction

  • Inventory direct and embedded Eclipse Jetty versions across internet-facing and internal Java services.
  • Upgrade Jetty or vendor packages according to Eclipse, Debian, and product vendor advisories.
  • Check proxy and gateway guidance for rejecting ambiguous HTTP request framing.
  • Prioritize services where authorization is enforced before requests reach Jetty.
  • Track downstream vendor advisories for products bundling affected Jetty components.

Validation and detection

  • Confirm Jetty major and minor versions in dependency manifests, runtime artifacts, and vendor bill of materials.
  • Map whether affected services sit behind authorization-enforcing intermediaries.
  • Review proxy and gateway configurations for handling duplicate length headers and chunked requests.
  • Check vulnerability scanner findings against actual deployed Jetty versions and packaging.
  • Look for unusual pipelined request patterns in relevant HTTP access logs.
Prepared
Confidence
medium
Sources
7

Public sources used

Generated from the cited source records. This long-tail analysis has not been individually reviewed by a named human.

Potential ATT&CK relevance

Conservative CVE-to-ATT&CK context

These mappings and lookup hints may be relevant to the vulnerability behavior, CWE, affected product, or exposure path. Glexia-inferred context is not an official MITRE, ATT&CK, CWE, or CVE Program mapping.

ATT&CK lookup starting points

Use these exact CWE pages and searches to review the Glexia ATT&CK library from this CVE's weakness and description context.

cwe · low confidence lookup

CWE-444: Exact CWE lookup

Use the exact CWE identifier as the starting point before reviewing related ATT&CK behavior. Open the exact CWE lookup page first, then review the ATT&CK searches from that MITRE weakness context. This is a Glexia lookup hint, not an official ATT&CK mapping.

Open ATT&CK lookup
cve · low confidence lookup

CVE-2017-7658 mapping review

Open the CVE-to-ATT&CK bridge for reviewed, inferred, or future official mappings tied to this CVE.

Open ATT&CK lookup
Vulnerability profileCVE Program record
Severity
Unknown
CVSS
Not scored
Known Exploited
No
Published
Official CVE source material

CNA and ADP enrichment extracted from CVE v5

These fields come from the CVE record and ADP containers, not from Glexia's Take. They preserve time-varying source decisions such as CISA SSVC, KEV status, CVSS metrics, and provider references.

0CVSS vectors
0Timeline events
0ADP providers
16Source links

CVSS and timeline data

No CVSS vectors or timeline events were available in the normalized CVE source material.

Source materials

Affected products

Products and packages named in the record

VendorProductVersion / packageStatus
The Eclipse FoundationEclipse Jettyunspecified, 9.3.0, unspecified, 9.4.0, unspecifiedListed
Weakness

CWE details

CWE-444

CWE links open Glexia weakness intelligence pages with official CWE context, developer remediation guidance, and related CVE mappings.

CWE-444 · source CWE mapping

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling')

Inconsistent Interpretation of HTTP Requests ('HTTP Request/Response Smuggling') represents a recurring weakness pattern that can create exploitable paths when design, validation, or implementation controls are missing.

Open CWE intelligenceSame-CWE CVEs