GZIP Request Body Inflation Vulnerability in Eclipse Jetty

CVE-2020-27218

What is CVE-2020-27218?

In certain versions of Eclipse Jetty, a vulnerability exists that allows for request body inflation if GZIP request body inflation is enabled and multiple client requests are sent over a single connection. An attacker can exploit this weakness by sending a request where the body is received completely but not processed. Consequently, the next request utilizing the same connection may inadvertently include the data from the previous request's body. While the attacker does not gain visibility to this data, they have the capability to inject arbitrary data into subsequent requests, potentially compromising the integrity of the application.

References