In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-jaasUpgrade jetty-websocket-apiUpgrade jetty-websocket-commonUpgrade jetty-xmlUpgrade jetty-runnerUpgrade jetty-javadocUpgrade jetty-jmxUpgrade jetty-rewriteUpgrade jetty-websocket-servletUpgrade jetty-websocket-parentUpgrade jetty-deployUpgrade jetty-servletsUpgrade jetty-servletUpgrade jetty-websocket-clientUpgrade jetty-proxyUpgrade jetty-serverUpgrade jetty-maven-pluginUpgrade jetty-projectUpgrade jetty-securityUpgrade jetty-utilUpgrade jetty-startUpgrade jetty-webappUpgrade jetty-clientUpgrade jetty-monitorUpgrade jetty-ioUpgrade jetty-continuationUpgrade jetty-jspc-maven-pluginUpgrade jetty-jndiUpgrade jetty-plusUpgrade jetty-jaspiUpgrade jetty-jspUpgrade jetty-httpUpgrade jetty-annotationsUpgrade jetty-util-ajaxUpgrade jetty-websocket-serverUpgrade jetty-ant | May 30, 2025 | Apr 1, 2021 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Debian | — | Upgrade jetty9 | Aug 6, 2021 | Apr 1, 2021 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Nov 4, 2022 | Apr 20, 2021 |
| Jenkins 2021 04 20 | — | Upgrade Jenkins to version 2.286Upgrade Jenkins LTS to version 2.277.3Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest version | Dec 2, 2021 | Apr 1, 2021 |
| Redhat Openshift | — | Upgrade runcUpgrade jenkins | May 21, 2021 | Apr 1, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 1, 2021 |
| Suse | — | Upgrade jetty-minimal-javadocUpgrade jetty-websocket-javadocUpgrade jetty-utilUpgrade jetty-servletUpgrade jetty-javax-websocket-server-implUpgrade jetty-serverUpgrade jetty-jmxUpgrade jetty-websocket-apiUpgrade jetty-clientUpgrade jetty-proxyUpgrade jetty-continuationUpgrade jetty-plusUpgrade jetty-annotationsUpgrade jetty-websocket-serverUpgrade jetty-websocket-clientUpgrade jetty-openidUpgrade jetty-websocket-commonUpgrade jetty-javax-websocket-client-implUpgrade jetty-util-ajaxUpgrade jetty-securityUpgrade jetty-ioUpgrade jetty-websocket-servletUpgrade jetty-jspUpgrade jetty-httpUpgrade jetty-webappUpgrade jetty-xmlUpgrade jetty-jaasUpgrade jetty-jndi | Jun 19, 2021 | Apr 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub