Eclipse Jetty Gzip Buffer Release Vulnerability Allowing Data Corruption and Leakage Between Requests

A vulnerability exists in Eclipse Jetty versions 9.4.0 prior to 9.4.56, where a buffer may be improperly released after a gzip error occurs while inflating a request body. This flaw can lead to data corruption and unintended sharing of request body data between different requests. The issue has been linked to Jetty's GzipHandler, which, under certain conditions, can cause parts of the request body from one request to overwrite those of another, particularly in high-volume environments.

Impact

Exploitation of this vulnerability can cause request body data from one API request to be mixed with that of another, leading to corrupted data being processed by the application.

Remediation

The vulnerability can be addressed by upgrading to Jetty version 9.4.57, which is the latest version and includes the necessary fix.