CVE-2020-27218

CVE-2020-27218 affects Eclipse Jetty versions 9.4.0.RC0 to 9.4.34.v20201102, 10.0.0.alpha0 to 10.0.0.beta2, and 11.0.0.alpha0 to 11.0.0.beta2, as well as products from Apache, Debian, NetApp, and Oracle that incorporate these Jetty versions. This medium-severity vulnerability (CVSS 4.8) occurs when GZIP request body inflation is enabled and requests are multiplexed on a single connection. An attacker can inject data into a subsequent request's body by sending a request with an unconsumed body, potentially leading to data integrity issues. There is no evidence of active exploitation, public exploit code, or significant community discussion surrounding this CVE.