CVE-2023-36478

A flaw was found in Jetty http2-hpack and http3-qpack. If header values exceed the size limit and Huffman is the trueMetaDataBuilder.checkSize, the multiplication will overflow, and the length will become negative, causing a large buffer allocation on the server, leading to a Denial of Service (DoS) attack.

This flaw requires a remote attacker to repeatedly send HTTP requests with HPACK, which could easily impact the server's performance or make it run out of memory. Hence, this vulnerability received an Important impact rating.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

No mitigations are currently available for this vulnerability.