CVE-2017-7657
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk...
Affects 18 products across 5 vendors.
Arithmetic operation exceeds the maximum integer value, wrapping around and often leading to undersized allocations.
Mapping is CWE-to-CAPEC per MITRE CAPEC 3.9.
This vulnerability was disclosed in 2018. A critical vulnerability affects Debian systems (CVE-2017-7657). No public exploit code is currently available. Isolate affected systems if patching is not feasible.
BSID: BS-2018-GLOBAL-121047-C • Model: rule-based-v1 • Confidence: MEDIUM
Is this CVE in your environment?
BreachSpider monitors your ICS/OT environment for vulnerabilities like this one. No agents or network access required. Free to start.
Check My Environment →What is CVE-2017-7657?
What is the CVSS score for CVE-2017-7657?
Is CVE-2017-7657 actively exploited?
How do I remediate CVE-2017-7657?
What systems are affected by CVE-2017-7657?
| CVE ID | CVE-2017-7657 |
|---|---|
| BSID | BS-2018-GLOBAL-121047-C BreachSpider Global ID |
| CVSS Vector | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H |
| Published | 2018-06-26 |
| Last Modified | 2026-06-17 |
| ICS Relevance | 0% |
| Weakness (CWE) | |
| Source | NVD |
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allowed arbitrarily large chunks to be passed on unchanged, then this flaw could be used to bypass the authorization imposed by the intermediary as the fake pipelined request would not be interpreted by the intermediary as a request.
Source: NIST NVD / MITRE CVE Database
Vulnerability details: In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration with RFC2616 compliance enabled), transfer-encoding chunks are handled poorly. The chunk length parsing was vulnerable to an integer overflow. Thus a large chunk size could be interpreted as a smaller chunk size and content sent as chunk body could be interpreted as a pipelined request. If Jetty was deployed behind an intermediary that imposed some authorization and that intermediary allo CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H.
Exploitation Likelihood: LOW
| Vendor | Product | Affected Versions |
|---|---|---|
| Debian | Debian Linux | 9.0 |
| Eclipse | Jetty | ≤ 9.2.26 ≥ 9.3.0, < 9.3.24 ≥ 9.4.0, < 9.4.11 |
| Hp | Xp P9000 Command View | ≥ 8.4.0-00, < 8.6.2-00 |
| Netapp | Element Software Management Node | No version listed by source |
| Netapp | Snapcenter | < 4.1p3 |
| Netapp | Oncommand Unified Manager | < 5.2.4 |
| Netapp | E-Series Santricity Web Services | No version listed by source |
| Netapp | Oncommand System Manager | 3.x |
| Netapp | Snap Creator Framework | < 4.3.3 |
| Netapp | Snapmanager | < 3.4.2 |
| Netapp | Hci Storage Nodes | No version listed by source |
| Netapp | E-Series Santricity Management | No version listed by source |
| Netapp | E-Series Santricity Os Controller | ≥ 11.0, ≤ 11.50.1 |
| Netapp | Element Software | No version listed by source |
| Netapp | Santricity Cloud Connector | No version listed by source |
| Oracle | Retail Xstore Point Of Service | 7.1 15.0 16.0 17.0 |
| Oracle | Rest Data Services | 11.2.0.4 12.1.0.2 12.2.0.1 18c |
Platforms listed by the source (the vulnerable product runs on these; they are not themselves vulnerable): Hp Xp P9000
| CISA known-exploited | Not in KEV catalog |
|---|---|
| Public Exploit | Not confirmed |
| PoC Code | Not confirmed |
AI Enrichment Record — provenance & audit hash
| Model | rule-based-v1 |
|---|---|
| Confidence | MEDIUM |
| Enriched At | 2026-05-24 |
| SHA-512 Audit Hash | b2a2ec5dbb22ffc70dea9d917631eefa625a2868256579a08b52a23926171a057d058d6ba360c94871cc96dd4c79002531716a85d4f8e03f152b9181228e2deb |
Critical Severity - Know Your Exposure
A CVSS 9.8 vulnerability in your ICS environment cannot wait. BreachSpider maps critical CVEs to your specific assets and tells you what to fix first.
Create a free account →