CVE-2023-40167 Jetty accepts "+" prefixed value in Content-Length
Jetty improperly accepts plus-prefixed Content-Length headers, potentially enabling request smuggling in specific proxy configurations.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2023-40167?
CVE-2023-40167 is a medium-severity vulnerability in Debian Debian Linux, published on 15 Sep 2023. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Jetty is a Java based web server and servlet engine. Prior to versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1, Jetty accepts the `+` character proceeding the content-length value in a HTTP/1 header field. This is more permissive than allowed by the RFC and other servers routinely reject such requests with 400 responses. There is no known exploit scenario, but it is conceivable that request smuggling could result if jetty is used in combination with a server that does not close the connection after sending such a 400 response. Versions 9.4.52, 10.0.16, 11.0.16, and 12.0.1 contain a patch for this issue. There is no workaround as there is no known exploit scenario.
Weakness: CWE-130
Which versions are affected by CVE-2023-40167?
8 open source packages ship an affected version, including org.eclipse.jetty:jetty-http. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-http Maven | From 10.0.0 | 10.0.16 |
org.eclipse.jetty:jetty-http Maven | From 10.0.0 | 10.0.16 |
org.eclipse.jetty:jetty-http Maven | From 11.0.0 | 11.0.16 |
org.eclipse.jetty:jetty-http Maven | From 11.0.0 | 11.0.16 |
org.eclipse.jetty:jetty-http Maven | From 12.0.0 | 12.0.1 |
org.eclipse.jetty:jetty-http Maven | From 12.0.0 | 12.0.1 |
2 more packages
org.eclipse.jetty:jetty-http Maven | From 9.0.0 | 9.4.52 |
org.eclipse.jetty:jetty-http Maven | From 9.0.0 | 9.4.52 |
Products include Debian Debian Linux, Eclipse Jetty.
How do I fix CVE-2023-40167?
Upgrade org.eclipse.jetty:jetty-http to a fixed version for your release line: 10.0.16, 11.0.16, 12.0.1 or 9.4.52.
Is CVE-2023-40167 being exploited?
There is no known exploitation of CVE-2023-40167 in the wild and no public exploit code.
Public exploit code: 1 proofs of concept on GitHub.
Other vulnerabilities in Debian Debian Linux
Sources
Also known as CLEANSTART-2025-JQ80087, CLEANSTART-2026-AW54675, CLEANSTART-2026-ID49738, DEBIAN-CVE-2023-40167, ECHO-996c-7d65-3491, GHSA-hmr7-m48g-48f6 and 4 more.