VulnerableCode Package Details - pkg:maven/org.eclipse.jetty.http2/http2-hpack@10.0.9

Search for packages

Vulnerability	Summary	Fixed by
VCID-ypc7-f1nd-t7gn Aliases: CVE-2023-36478 GHSA-wgh7-54f2-x98r	Uncontrolled Resource Consumption Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.	10.0.16 Affected by 0 other vulnerabilities. 11.0.16 Affected by 0 other vulnerabilities.

Vulnerability

Summary

Fixed by

VCID-ypc7-f1nd-t7gn
Aliases:
CVE-2023-36478
GHSA-wgh7-54f2-x98r

Uncontrolled Resource Consumption Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

10.0.16
Affected by 0 other vulnerabilities.

11.0.16
Affected by 0 other vulnerabilities.

Vulnerability	Summary	Aliases
This package is not known to fix vulnerabilities.

Vulnerability

Summary

Aliases

This package is not known to fix vulnerabilities.

Date	Actor	Action	Vulnerability	Source	VulnerableCode Version
2026-04-16T22:40:22.984827+00:00	GitLab Importer	Affected by	VCID-ypc7-f1nd-t7gn	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/http2-hpack/CVE-2023-36478.yml	38.4.0
2026-04-11T23:59:50.378784+00:00	GitLab Importer	Affected by	VCID-ypc7-f1nd-t7gn	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/http2-hpack/CVE-2023-36478.yml	38.3.0
2026-04-03T00:02:53.992460+00:00	GitLab Importer	Affected by	VCID-ypc7-f1nd-t7gn	https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/http2-hpack/CVE-2023-36478.yml	38.1.0