CVE-2020-27218

In Eclipse Jetty, when GZIP compression is enabled and multiple clients share a connection, leftover data from one client's request can be accidentally prepended to another client's request body. This allows an attacker to inject data into someone else's request without being detected.

A request body inflation vulnerability occurs when GZIP decompression is enabled on multiplexed connections in Jetty. If a request body is fully received but not consumed by the application, the unconsumed data remains in the buffer and contaminates the next request on the same connection. An attacker can craft a request designed not to be consumed, injecting malicious data into a subsequent victim's request body.