OutOfMemoryError for large multipart without filename in Eclipse Jetty
Moderate severity
GitHub Reviewed
Published
Apr 18, 2023
in
jetty/jetty.project
•
Updated Nov 6, 2023
Package
Affected versions
>= 10.0.0, < 10.0.14
>= 11.0.0, < 11.0.14
< 9.4.51.v20230217
Patched versions
10.0.14
11.0.14
9.4.51.v20230217
Description
Published by the National Vulnerability Database
Apr 18, 2023
Published to the GitHub Advisory Database
Apr 19, 2023
Reviewed
Apr 19, 2023
Last updated
Nov 6, 2023
Credits
-
lachlan-roberts Analyst
-
jeffalder Analyst
Impact
Servlets with multipart support (e.g. annotated with
@MultipartConfig) that callHttpServletRequest.getParameter()orHttpServletRequest.getParts()may causeOutOfMemoryErrorwhen the client sends a multipart request with a part that has a name but no filename and a very large content.This happens even with the default settings of
fileSizeThreshold=0which should stream the whole part content to disk.An attacker client may send a large multipart request and cause the server to throw
OutOfMemoryError.However, the server may be able to recover after the
OutOfMemoryErrorand continue its service -- although it may take some time.A very large number of parts may cause the same problem.
Patches
Patched in Jetty versions
Workarounds
Multipart parameter
maxRequestSizemust be set to a non-negative value, so the whole multipart content is limited (although still read into memory).Limiting multipart parameter
maxFileSizewon't be enough because an attacker can send a large number of parts that summed up will cause memory issues.References
References