CVE-2023-40167

mediumpriority · track · 31EPSS 0.013 · 70 %ileexploit · PoCDEEUNLRUUS

grimoire priorityP1 · Urgent

Exploitable?

Public exploit

1 exploit · PoC

Likely / severe?

1.28% (70th) EPSS

CVSS 5.3 · medium

Is it mine?

73 products

Check your exposure

Who says so?

6 sources

cnnvd · enisa_euvd · fstec_bdu · cert_bund

EPSS · scored 2026-10-22

Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.

cvss

Technical severity, 0–10. One row per scoring source.

7.5

010

base score 0–10 · higher = more severe · hover a vector to decode⚠ sources disagree · medium–high · 5–7.5

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nprimary · NVD / NIST USexploitability 3.9 · impact 1.4

v3.15.3mediumAV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · FSTEC (BDU) RU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · ENISA EU

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · security-advisories@github.comexploitability 3.9 · impact 1.4

v3.15.3mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:Nsecondary · OSV

v3.15mediumCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N/E:Psecondary · CVSS-BT (t0sche)

v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · NCSC-NL NL

ssvc

A stakeholder decision — act, attend, or track — from exploitation and impact.

Exploitation: none · Automatable: yes · Technical Impact: partialcoordinatorcisa_ssvcUS

weaknesses

The CWE weakness classes this flaw belongs to.

CWE-130USCWE-130USCWE-130USCWE-130US

exploits (1)

Public proof-of-concept and weaponised exploit code.

uthrasri/Jetty-v9.4.31_CVE-2023-40167uthrasri/Jetty-v9.4.31_CVE-2023-40167PoC · poc_in_github

affected products (73)

Products and version ranges known to be affected.

Dell ECS <3.8.1.0all versionscert_bundDE
Dell PowerEdgeall versionscert_bundDEcpe:/h:dell:poweredge:-
IBM InfoSphere Information Serverall versionscert_bundDEcpe:/a:ibm:infosphere_information_server:-
Dell ECS< 3.8.1.0cert_bundDE
eclipse jetty.project≤ 9.0.0, ≤ 9.4.51enisa_euvdEU
eclipse jetty.project≤ 10.0.0, ≤ 10.0.15enisa_euvdEU
eclipse jetty.project≤ = 12.0.0enisa_euvdEU
eclipse jetty.project≤ 11.0.0, ≤ 11.0.15enisa_euvdEU
Eclipse Foundation Jetty≤ 12.0.0 beta1fstec_bduRU
Eclipse Foundation Jetty≤ 12.0.0 beta0fstec_bduRU
Eclipse Foundation Jetty≤ 12.0.0 beta4fstec_bduRU
Eclipse Foundation Jetty≤ 12.0.0 beta3fstec_bduRU
Eclipse Foundation Jetty≤ 12.0.0 beta2fstec_bduRU
Eclipse Foundation Jetty≤ 12.0.0fstec_bduRU
Eclipse Foundation Jetty10.0.0 → 10.0.16fstec_bduRU
Eclipse Foundation Jetty11.0.0 → 11.0.16fstec_bduRU
Eclipse Foundation Jetty9.0.0 → 9.4.52fstec_bduRU
Elastic NV Archi≤ 4.8.1fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.4fstec_bduRU
Novell Inc. OpenSUSE Leap≤ 15.5fstec_bduRU

showing 20 of 73

advisories (10)

Vendor and ecosystem advisories describing this.

NCSC-2024-0296Kwetsbaarheden verholpen in Oracle Enterprise ManagerNL2024-07-17csaf · ncsc_nlNL
Er zijn kwetsbaarheden verholpen in Oracle Enterprise Manager.
WID-SEC-W-2023-2359Eclipse Jetty: Mehrere SchwachstellenDeutsch2023-09-14csaf · cert_bundDE
Ein entfernter authentifizierter Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um beliebigen Code auszuführen, Sicherheitsmaßnahmen zu umgehen oder einen HTTP-Cache-Poison-Angriff durchzuführen.
WID-SEC-W-2023-2679Oracle Communications: Mehrere SchwachstellenDeutsch2023-10-17csaf · cert_bundDE
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2023-3070Red Hat JBoss A-MQ: Mehrere SchwachstellenDeutsch2023-12-06csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss A-MQ ausnutzen, um Sicherheitsvorkehrungen zu umgehen, Informationen offenzulegen, Dateien zu manipulieren oder einen Denial of Service Zustand herbeizuführen.
WID-SEC-W-2024-0106Oracle Communications: Mehrere SchwachstellenDeutsch2024-01-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Communications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2024-0794Dell ECS: Mehrere SchwachstellenDeutsch2024-04-04csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Dell ECS ausnutzen, um seine Privilegien zu erweitern, beliebigen Programmcode mit Administratorrechten auszuführen, Informationen offenzulegen, Dateien zu manipulieren, einen Cross-Site-Scripting-Angriff durchzuführen, Sicherheitsvorkehrungen zu umgehen oder einen Denial of Service Zustand herbeizuführen.
WID-SEC-W-2024-0949Red Hat Satellite: Mehrere SchwachstellenDeutsch2024-04-23csaf · cert_bundDE
Ein Angreifer kann mehrere Schwachstellen in Red Hat Satellite ausnutzen, um Sicherheitsmaßnahmen zu umgehen, einen Denial-of-Service-Zustand herbeizuführen, vertrauliche Informationen offenzulegen, Dateien zu manipulieren, HTTP-Request-Smuggling-Angriffe durchzuführen oder Phishing- und Cross-Site-Scripting (XSS)-Angriffe auszuführen.
WID-SEC-W-2024-1639Oracle Enterprise Manager: Mehrere SchwachstellenDeutsch2024-07-16csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Enterprise Manager ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
WID-SEC-W-2025-0810Oracle Retail Applications: Mehrere SchwachstellenDeutsch2025-04-15csaf · cert_bundDE
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Oracle Retail Applications ausnutzen, um die Vertraulichkeit, Integrität und Verfügbarkeit zu gefährden.
GHSA-hmr7-m48g-48f6Jetty accepts "+" prefixed value in Content-Length2023-09-14ghsa · osvUS
### Impact Jetty accepts the '+' character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. ### Workarounds There is no workaround as there is no known exploit scenario. ### Original Report [RFC 9110 Secion 8.6](https://www.rfc-editor.org/rfc/rfc9110#section-8.6) defined the value of Content-Length header should be a string of 0-9 digits. However we found that Jetty accepts "+" prefixed Content-Length, which could lead to potential HTTP request smuggling. Payload: ``` POST / HTTP/1.1 Host: a.com Content-Length: +16 Connection: close 0123456789abcdef ``` When sending this payload to Jetty, it can successfully parse and identify the length. When sending this payload to NGINX, Apache HTTPd or other HTTP servers/parsers, they will return 400 bad request. This behavior can lead to HTTP request smuggling and can be leveraged to bypass WAF or IDS.

also known as (4)

Other names and identifiers for this entity.

sources

Which sources assert this record, and when.

cnnvd enisa_euvd fstec_bdu cert_bund ncsc_nl osv NVD CVE.org MITRE

published 2023-09-15modified 2026-06-17

references (20)

External citations — patches, advisories, analysis.

scry

Attackers weaponise vulnerabilities like this against internet-exposed services. See what is exposed on your perimeter with a free passive scan.

Free scan