CVE-2020-27223
MediumIn Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e.
Published Aug 19, 2021 · Updated Sep 10, 2026 · Also known as BIT-nifi-2020-27223, BIT-solr-2020-27223, BIT-spark-2020-27223, DEBIAN-CVE-2020-27223, GHSA-m394-8rww-3jr7, SUSE-SU-2021:0940-1, UBUNTU-CVE-2020-27223
Key Facts
Patch immediately- CVE-2020-27223 is a medium-severity vulnerability (CVSS 5.3 v3.1) affecting Nifi (Apache), Solr (Apache), Spark (Apache) and 22 more products.
- It is not listed in any known-exploited vulnerabilities catalog. No public exploit code is known.
- EPSS estimates a 78% probability of exploitation in the next 30 days.
- Fixed versions are available, including Jetty 9.4.36, Jetty unspecified, jenkins 0:2.277.3.1623846768-1.el7.
- Brandefense priority: patch immediately, because it is very likely to be exploited soon.
CVSS v3.1
5.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
EPSS (30-day exploit likelihood)
78%
Higher than 99.5% of all scored CVEs
Exploited in the wild
No known
Not in a known-exploited catalog
Public exploit code
None known
Get the full CVE-2020-27223 brief as a PDF
Every affected product and fixed release, exploitation status and a first 24 hours response checklist, emailed within minutes.
Description
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
Affected Products
98 affected entries in total| Product | Affected versions | Fixed in |
|---|---|---|
| NifiApache | 1.13.0, >= 1.13.0 | n/a |
| SolrApache | 8.8.1, >= 8.8.1 | 8.8.2 |
| SparkApache | 3.1.1, >= 3.1.1 | 3.1.2 |
| JettyEclipse | 10.0.0, 11.0.0, 9.4.36, 9.4.36-20210114, 9.4.6-20170531, 9.4.6-20180619, >= 9.4.6.v20170531 | 9.4.36 |
| Element Plug-In For Vcenter ServerNetapp | See advisory | n/a |
Patched Releases
Jetty
9.4.36, unspecified
jenkins
0:2.277.3.1623846768-1.el7, 0:2.277.3.1623853726-1.el8
jetty-annotations
9.4.43-1.2
jetty-ant
9.4.43-1.2
jetty-cdi
9.4.43-1.2
jetty-client
9.4.43-1.2
jetty-continuation
9.4.43-1.2
jetty-deploy
9.4.43-1.2
jetty-fcgi
9.4.43-1.2
jetty-http
9.4.38-3.6.2, 9.4.43-1.2
jetty-http-spi
9.4.43-1.2
jetty-io
9.4.38-3.6.2, 9.4.43-1.2
jetty-jaas
9.4.43-1.2
jetty-jmx
9.4.43-1.2
jetty-jndi
9.4.43-1.2
jetty-jsp
9.4.43-1.2
jetty-minimal
9.4.38-3.6.2
jetty-minimal-javadoc
9.4.43-1.2
jetty-openid
9.4.43-1.2
jetty-plus
9.4.43-1.2
jetty-proxy
9.4.43-1.2
jetty-quickstart
9.4.43-1.2
jetty-rewrite
9.4.43-1.2
jetty-security
9.4.38-3.6.2, 9.4.43-1.2
jetty-server
9.4.38-3.6.2, 9.4.43-1.2
Timeline
Publicly disclosed
Aug 19, 2021
Last updated
Sep 10, 2026
Weakness Type
- CWE-400 Uncontrolled Resource Consumption
- CWE-407 Inefficient Algorithmic Complexity
References
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3449
- advisoryhttp://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-3450
- advisoryRHBA-2021:2854
- advisoryRHSA-2021:2431
- advisoryRHSA-2021:2499
FAQ
Common Questions.
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e.
Affected: Nifi (Apache) versions 1.13.0, >= 1.13.0; Solr (Apache) versions 8.8.1, >= 8.8.1; Spark (Apache) versions 3.1.1, >= 3.1.1, among others. The full list is in the CVE brief.
It is not listed in any known-exploited vulnerabilities catalog.
No, it is not currently listed in the CISA Known Exploited Vulnerabilities catalog.
No public exploit code is known.
Fixed versions are available, including Jetty 9.4.36, Jetty unspecified, jenkins 0:2.277.3.1623846768-1.el7.
Brandefense priority: patch immediately, because it is very likely to be exploited soon.
Is CVE-2020-27223 Running On Your Attack Surface?
Brandefense maps vulnerabilities like this one to your internet-facing assets and tells you exactly where to patch.
Request A Demo