CVE-2023-26048

Jetty is a java based web server and servlet engine. In affected versions servlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and very large content. This happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk. An attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`. However, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time. This issue has been patched in versions 9.4.51, 10.0.14, and 11.0.14. Users are advised to upgrade. Users unable to upgrade may set the multipart parameter `maxRequestSize` which must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).

• CWE-400
• CWE-770

• https://github.com/eclipse/jetty.project/issues/9076Patch
• https://github.com/eclipse/jetty.project/pull/9344Patch
• https://github.com/eclipse/jetty.project/pull/9345Patch
• https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8Vendor Advisory
• https://github.com/jakartaee/servlet/blob/6.0.0/spec/src/main/asciidoc/servlet-spec-body.adoc#32-file-uploadTechnical Description
• https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html
• https://security.netapp.com/advisory/ntap-20230526-0001/
• https://www.debian.org/security/2023/dsa-5507
• https://github.com/eclipse/jetty.project/issues/9076Patch
• https://github.com/eclipse/jetty.project/pull/9344Patch
• https://github.com/eclipse/jetty.project/pull/9345Patch
• https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8Vendor Advisory
• https://github.com/jakartaee/servlet/blob/6.0.0/spec/src/main/asciidoc/servlet-spec-body.adoc#32-file-uploadTechnical Description
• https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html
• https://security.netapp.com/advisory/ntap-20230526-0001/
• https://www.debian.org/security/2023/dsa-5507

Published

Apr 18, 2023

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2023-26042Part-DB is an open source inventory management system for yo…6.1
• CVE-2023-26043GeoNode is an open source platform that facilitates the crea…6.5
• CVE-2023-26044react/http is an event-driven, streaming HTTP client and ser…5.3
• CVE-2023-26045NodeBB is Node.js based forum software. Starting in version …9.8
• CVE-2023-26046teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26047teler-waf is a Go HTTP middleware that provides teler IDS fu…6.1
• CVE-2023-26049Jetty is a java based web server and servlet engine. Nonstan…5.3
• CVE-2023-2605The wpbrutalai WordPress plugin before 2.0.1 does not saniti…6.1
• CVE-2023-26051Saleor is a headless, GraphQL commerce platform delivering p…4.3
• CVE-2023-26052Saleor is a headless, GraphQL commerce platform delivering p…5.3
• CVE-2023-26053Gradle is a build tool with a focus on build automation and …9.8
• CVE-2023-26054BuildKit is a toolkit for converting source code to build ar…6.5