In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-rewriteUpgrade jetty-servletUpgrade jetty-runnerUpgrade jetty-websocket-servletUpgrade jetty-deployUpgrade jetty-websocket-apiUpgrade jetty-servletsUpgrade jetty-websocket-parentUpgrade jetty-jaasUpgrade jetty-javadocUpgrade jetty-jmxUpgrade jetty-proxyUpgrade jetty-websocket-clientUpgrade jetty-xmlUpgrade jetty-websocket-commonUpgrade jetty-util-ajaxUpgrade jetty-projectUpgrade jetty-jaspiUpgrade jetty-ioUpgrade jetty-annotationsUpgrade jetty-clientUpgrade jetty-jspUpgrade jetty-securityUpgrade jetty-httpUpgrade jetty-monitorUpgrade jetty-utilUpgrade jetty-continuationUpgrade jetty-serverUpgrade jetty-plusUpgrade jetty-startUpgrade jetty-websocket-serverUpgrade jetty-antUpgrade jetty-maven-pluginUpgrade jetty-jspc-maven-pluginUpgrade jetty-jndiUpgrade jetty-webapp | May 30, 2025 | Apr 1, 2021 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Debian | — | Upgrade jetty9 | Aug 6, 2021 | Apr 1, 2021 |
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Nov 4, 2022 | Apr 20, 2021 |
| Jenkins 2021 04 20 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.277.3Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.286 | Dec 2, 2021 | Apr 1, 2021 |
| Redhat Openshift | — | Upgrade jenkinsUpgrade runc | May 21, 2021 | Apr 1, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 1, 2021 |
| Suse | — | Upgrade jetty-webappUpgrade jetty-jndiUpgrade jetty-jaasUpgrade jetty-httpUpgrade jetty-websocket-servletUpgrade jetty-xmlUpgrade jetty-util-ajaxUpgrade jetty-javax-websocket-client-implUpgrade jetty-securityUpgrade jetty-jspUpgrade jetty-websocket-commonUpgrade jetty-ioUpgrade jetty-proxyUpgrade jetty-annotationsUpgrade jetty-utilUpgrade jetty-websocket-javadocUpgrade jetty-serverUpgrade jetty-jmxUpgrade jetty-openidUpgrade jetty-websocket-clientUpgrade jetty-websocket-apiUpgrade jetty-minimal-javadocUpgrade jetty-clientUpgrade jetty-plusUpgrade jetty-continuationUpgrade jetty-javax-websocket-server-implUpgrade jetty-websocket-serverUpgrade jetty-servlet | Jun 19, 2021 | Apr 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub