CVE-2020-27218 Buffer not correctly recycled in Gzip Request inflation
Attackers can inject data into subsequent request bodies when GZIP inflation is enabled and requests are multiplexed, potentially corrupting application data.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2020-27218?
CVE-2020-27218 is a medium-severity vulnerability in Debian Debian Linux, published on 28 Nov 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jetty version 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, if GZIP request body inflation is enabled and requests from different clients are multiplexed onto a single connection, and if an attacker can send a request with a body that is received entirely but not consumed by the application, then a subsequent request on the same connection will see that body prepended to its body. The attacker will not see any data but may inject data into the body of the subsequent request.
Weakness: CWE-226
Which versions are affected by CVE-2020-27218?
4 open source packages ship an affected version, including org.eclipse.jetty:jetty-server, kafka and spark. It affects 17 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.35.v20201120 |
org.eclipse.jetty:jetty-server Maven | From 9.4.0 | 9.4.35.v20201120 |
kafka Bitnami | From 2.7.0 | 2.7.1 |
spark Bitnami | From 2.4.8 | 2.4.9, 3.0.4 |
Linux distribution packages (3)
jetty-minimal SUSE:Linux Enterprise Module for Development Tools 15 SP2 | All versions | 9.4.35-3.3.4 |
jetty-minimal openSUSE:Leap 15.2 | All versions | 9.4.35-lp152.2.3.1 |
jetty-websocket openSUSE:Leap 15.2 | All versions | 9.4.35-lp152.2.3.1 |
Products include Apache Kafka, Apache Spark, Debian Debian Linux, Eclipse Jetty, Netapp Oncommand System Manager, Netapp Snap Creator Framework and 11 more.
How do I fix CVE-2020-27218?
Upgrade org.eclipse.jetty:jetty-server to 9.4.35.v20201120 or later.
Is CVE-2020-27218 being exploited?
There is no known exploitation of CVE-2020-27218 in the wild and no public exploit code.
Other vulnerabilities in Debian Debian Linux
- CVE-2026-33557 Apache Kafka: Missing JWT token validation in OAUTHBEARER authentication
- CVE-2025-27818 Apache Kafka: Possible RCE attack via SASL JAAS LdapLoginModule configuration
- CVE-2018-17196 Improper Input Validation in Apache Kafka
- CVE-2026-35554 Apache Kafka Clients: Kafka Producer Message Corruption and Misrouting via Buffer Pool Race Condition
- CVE-2025-27817 Apache Kafka Client: Arbitrary file read and SSRF vulnerability
Sources
Also known as BIT-kafka-2020-27218, BIT-spark-2020-27218, DEBIAN-CVE-2020-27218, GHSA-86wm-rrjm-8wh8, SUSE-SU-2020:3922-1, UBUNTU-CVE-2020-27218 and 1 more.