CVE-2023-26048: Jetty server OutOfMemoryError For Large Multipart Without Vulnerability

{
  "schema_version" : "1.4.0",
  "id" : "GHSA-qw69-rqj8-6qw8",
  "modified" : "2023-04-19T18:15:45Z",
  "published" : "2023-04-19T18:15:45Z",
  "aliases" : [ "CVE-2023-26048" ],
  "summary" : "OutOfMemoryError for large multipart without filename in Eclipse Jetty",
  "details" : "### Impact\nServlets with multipart support (e.g. annotated with `@MultipartConfig`) that call `HttpServletRequest.getParameter()` or `HttpServletRequest.getParts()` may cause `OutOfMemoryError` when the client sends a multipart request with a part that has a name but no filename and a very large content.\n\nThis happens even with the default settings of `fileSizeThreshold=0` which should stream the whole part content to disk.\n\nAn attacker client may send a large multipart request and cause the server to throw `OutOfMemoryError`.\nHowever, the server may be able to recover after the `OutOfMemoryError` and continue its service -- although it may take some time.\n\nA very large number of parts may cause the same problem.\n\n### Patches\nPatched in Jetty versions\n\n* 9.4.51.v20230217 - via PR #9345\n* 10.0.14 - via PR #9344\n* 11.0.14 - via PR #9344\n\n### Workarounds\nMultipart parameter `maxRequestSize` must be set to a non-negative value, so the whole multipart content is limited (although still read into memory).\nLimiting multipart parameter `maxFileSize` won't be enough because an attacker can send a large number of parts that summed up will cause memory issues.\n\n### References\n* https://github.com/eclipse/jetty.project/issues/9076\n* https://github.com/jakartaee/servlet/blob/6.0.0/spec/src/main/asciidoc/servlet-spec-body.adoc#32-file-upload\n",
  "severity" : [ {
    "type" : "CVSS_V3",
    "score" : "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L"
  } ],
  "affected" : [ {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty:jetty-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "0"
      }, {
        "fixed" : "9.4.51.v20230217"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty:jetty-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "10.0.0"
      }, {
        "fixed" : "10.0.14"
      } ]
    } ]
  }, {
    "package" : {
      "ecosystem" : "Maven",
      "name" : "org.eclipse.jetty:jetty-server"
    },
    "ranges" : [ {
      "type" : "ECOSYSTEM",
      "events" : [ {
        "introduced" : "11.0.0"
      }, {
        "fixed" : "11.0.14"
      } ]
    } ]
  } ],
  "references" : [ {
    "type" : "WEB",
    "url" : "https://github.com/eclipse/jetty.project/security/advisories/GHSA-qw69-rqj8-6qw8"
  }, {
    "type" : "ADVISORY",
    "url" : "https://nvd.nist.gov/vuln/detail/CVE-2023-26048"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/eclipse/jetty.project/issues/9076"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/eclipse/jetty.project/pull/9344"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/eclipse/jetty.project/pull/9345"
  }, {
    "type" : "PACKAGE",
    "url" : "https://github.com/eclipse/jetty.project"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.51.v20230217"
  }, {
    "type" : "WEB",
    "url" : "https://github.com/jakartaee/servlet/blob/6.0.0/spec/src/main/asciidoc/servlet-spec-body.adoc#32-file-upload"
  }, {
    "type" : "WEB",
    "url" : "https://lists.debian.org/debian-lts-announce/2023/09/msg00039.html"
  }, {
    "type" : "WEB",
    "url" : "https://security.netapp.com/advisory/ntap-20230526-0001"
  }, {
    "type" : "WEB",
    "url" : "https://www.debian.org/security/2023/dsa-5507"
  } ],
  "database_specific" : {
    "cwe_ids" : [ "CWE-400", "CWE-770" ],
    "severity" : "MODERATE",
    "github_reviewed" : true,
    "github_reviewed_at" : "2023-04-19T18:15:45Z",
    "nvd_published_at" : "2023-04-18T21:15:08Z"
  }
}