CVE-2023-36478 HTTP/2 HPACK integer overflow and buffer allocation

What is CVE-2023-36478?

CVE-2023-36478 is a high-severity vulnerability in Debian Debian Linux, published on 10 Oct 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in `MetaDataBuilder.checkSize` allows for HTTP/2 HPACK header values to exceed their size limit. `MetaDataBuilder.java` determines if a header name or value exceeds the size limit, and throws an exception if the limit is exceeded. However, when length is very large and huffman is true, the multiplication by 4 in line 295 will overflow, and length will become negative. `(_size+length)` will now be negative, and the check on line 296 will not be triggered. Furthermore, `MetaDataBuilder.checkSize` allows for user-entered HPACK header value sizes to be negative, potentially leading to a very large buffer allocation later on when the user-entered size is multiplied by 2. This means that if a user provides a negative length value (or, more precisely, a length value which, when multiplied by the 4/3 fudge factor, is negative), and this length value is a very large positive number when multiplied by 2, then the user can cause a very large buffer to be allocated on the server. Users of HTTP/2 can be impacted by a remote denial of service attack. The issue has been fixed in versions 11.0.16, 10.0.16, and 9.4.53. There are no known workarounds.

Weakness: CWE-400, CWE-190

Which versions are affected by CVE-2023-36478?

11 open source packages ship an affected version, including org.eclipse.jetty.http2:http2-hpack, jenkins and org.eclipse.jetty.http3:http3-qpack. It affects 3 products.

Products include Debian Debian Linux, Eclipse Jetty, Jenkins Jenkins.

How do I fix CVE-2023-36478?

Upgrade org.eclipse.jetty.http2:http2-hpack to a fixed version for your release line: 10.0.16, 11.0.16 or 9.4.53.

Is CVE-2023-36478 being exploited?

There is no known exploitation of CVE-2023-36478 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-jenkins-2023-36478, DEBIAN-CVE-2023-36478, GHSA-wgh7-54f2-x98r, UBUNTU-CVE-2023-36478.