CVE-2023-40167
jetty: Improper validation of HTTP/1 content-length
Severity
ModerateRed Hat Product Security
CVSS 3.1
Review impact separately from score.
Published · September 19, 2023
Updated · October 12, 2026
Description
A flaw was found in Jetty that permits a plus sign (+) preceding the content-length value in a HTTP/1 header field, which is non-standard and more permissive than RFC. This issue could allow an attacker to request smuggling in conjunction with a server that does not close connections after 400 responses.
CVSS score applicability
The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.
Mitigation
No mitigation is specified in collected source.
CVSS / CWE
CVSS 3.1 · 5.3CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N
CWE-130 · Improper Handling of Length Parameter Inconsistency