In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-xmlUpgrade jetty-websocket-commonUpgrade jetty-deployUpgrade jetty-rewriteUpgrade jetty-proxyUpgrade jetty-runnerUpgrade jetty-websocket-servletUpgrade jetty-javadocUpgrade jetty-jaasUpgrade jetty-websocket-clientUpgrade jetty-websocket-apiUpgrade jetty-jmxUpgrade jetty-websocket-parentUpgrade jetty-servletUpgrade jetty-servletsUpgrade jetty-projectUpgrade jetty-httpUpgrade jetty-securityUpgrade jetty-jspUpgrade jetty-websocket-serverUpgrade jetty-plusUpgrade jetty-webappUpgrade jetty-clientUpgrade jetty-annotationsUpgrade jetty-monitorUpgrade jetty-util-ajaxUpgrade jetty-jaspiUpgrade jetty-continuationUpgrade jetty-jspc-maven-pluginUpgrade jetty-startUpgrade jetty-maven-pluginUpgrade jetty-serverUpgrade jetty-ioUpgrade jetty-utilUpgrade jetty-jndiUpgrade jetty-ant | May 30, 2025 | Apr 1, 2021 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Debian | — | Upgrade jetty9 | Aug 6, 2021 | Apr 1, 2021 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Nov 4, 2022 | Apr 20, 2021 |
| Jenkins 2021 04 20 | — | Upgrade Jenkins to version 2.286Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.277.3Upgrade Jenkins to the latest version | Dec 2, 2021 | Apr 1, 2021 |
| Redhat Openshift | — | Upgrade jenkinsUpgrade runc | May 21, 2021 | Apr 1, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 1, 2021 |
| Suse | — | Upgrade jetty-servletUpgrade jetty-websocket-apiUpgrade jetty-websocket-javadocUpgrade jetty-utilUpgrade jetty-javax-websocket-server-implUpgrade jetty-minimal-javadocUpgrade jetty-continuationUpgrade jetty-websocket-serverUpgrade jetty-websocket-clientUpgrade jetty-proxyUpgrade jetty-clientUpgrade jetty-plusUpgrade jetty-jmxUpgrade jetty-openidUpgrade jetty-annotationsUpgrade jetty-serverUpgrade jetty-httpUpgrade jetty-util-ajaxUpgrade jetty-websocket-servletUpgrade jetty-xmlUpgrade jetty-jspUpgrade jetty-websocket-commonUpgrade jetty-jaasUpgrade jetty-webappUpgrade jetty-javax-websocket-client-implUpgrade jetty-jndiUpgrade jetty-ioUpgrade jetty-security | Jun 19, 2021 | Apr 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub