CVE-2023-26048
jetty-server: OutOfMemoryError for large multipart without filename read via request.getParameter()
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · April 18, 2023
Updated · August 9, 2026
Description
A flaw was found in the jetty-server package. A servlet with multipart support could get an OutOfMemorryError when the client sends a part that has a name but no filename and substantial content. This flaw allows a malicious user to jeopardize the environment by leaving the JVM in an unreliable state.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
CWE-770 · Allocation of Resources Without Limits or Throttling