In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-websocket-clientUpgrade jetty-servletsUpgrade jetty-jaasUpgrade jetty-websocket-servletUpgrade jetty-deployUpgrade jetty-servletUpgrade jetty-javadocUpgrade jetty-jmxUpgrade jetty-websocket-apiUpgrade jetty-websocket-commonUpgrade jetty-rewriteUpgrade jetty-websocket-parentUpgrade jetty-runnerUpgrade jetty-xmlUpgrade jetty-proxyUpgrade jetty-webappUpgrade jetty-annotationsUpgrade jetty-jspc-maven-pluginUpgrade jetty-utilUpgrade jetty-maven-pluginUpgrade jetty-jaspiUpgrade jetty-ioUpgrade jetty-jndiUpgrade jetty-continuationUpgrade jetty-serverUpgrade jetty-securityUpgrade jetty-util-ajaxUpgrade jetty-startUpgrade jetty-plusUpgrade jetty-websocket-serverUpgrade jetty-projectUpgrade jetty-antUpgrade jetty-jspUpgrade jetty-httpUpgrade jetty-monitorUpgrade jetty-client | May 30, 2025 | Apr 1, 2021 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Debian | — | Upgrade jetty9 | Aug 6, 2021 | Apr 1, 2021 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Nov 4, 2022 | Apr 20, 2021 |
| Jenkins 2021 04 20 | — | Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.286Upgrade Jenkins LTS to version 2.277.3Upgrade Jenkins LTS to the latest version | Dec 2, 2021 | Apr 1, 2021 |
| Redhat Openshift | — | Upgrade runcUpgrade jenkins | May 21, 2021 | Apr 1, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 1, 2021 |
| Suse | — | Upgrade jetty-ioUpgrade jetty-util-ajaxUpgrade jetty-javax-websocket-client-implUpgrade jetty-securityUpgrade jetty-xmlUpgrade jetty-jspUpgrade jetty-websocket-servletUpgrade jetty-websocket-commonUpgrade jetty-jaasUpgrade jetty-webappUpgrade jetty-httpUpgrade jetty-jndiUpgrade jetty-clientUpgrade jetty-websocket-clientUpgrade jetty-websocket-javadocUpgrade jetty-websocket-apiUpgrade jetty-plusUpgrade jetty-proxyUpgrade jetty-servletUpgrade jetty-utilUpgrade jetty-javax-websocket-server-implUpgrade jetty-continuationUpgrade jetty-websocket-serverUpgrade jetty-jmxUpgrade jetty-annotationsUpgrade jetty-serverUpgrade jetty-openidUpgrade jetty-minimal-javadoc | Jun 19, 2021 | Apr 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub