In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-servletsUpgrade jetty-deployUpgrade jetty-jaasUpgrade jetty-proxyUpgrade jetty-websocket-parentUpgrade jetty-websocket-servletUpgrade jetty-websocket-commonUpgrade jetty-javadocUpgrade jetty-websocket-apiUpgrade jetty-websocket-clientUpgrade jetty-servletUpgrade jetty-jmxUpgrade jetty-xmlUpgrade jetty-runnerUpgrade jetty-rewriteUpgrade jetty-projectUpgrade jetty-plusUpgrade jetty-utilUpgrade jetty-ioUpgrade jetty-continuationUpgrade jetty-jspc-maven-pluginUpgrade jetty-jndiUpgrade jetty-serverUpgrade jetty-jaspiUpgrade jetty-webappUpgrade jetty-clientUpgrade jetty-startUpgrade jetty-util-ajaxUpgrade jetty-httpUpgrade jetty-maven-pluginUpgrade jetty-annotationsUpgrade jetty-securityUpgrade jetty-monitorUpgrade jetty-jspUpgrade jetty-websocket-serverUpgrade jetty-ant | May 30, 2025 | Apr 1, 2021 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Debian | — | Upgrade jetty9 | Aug 6, 2021 | Apr 1, 2021 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Nov 4, 2022 | Apr 20, 2021 |
| Jenkins 2021 04 20 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.277.3Upgrade Jenkins to version 2.286Upgrade Jenkins to the latest version | Dec 2, 2021 | Apr 1, 2021 |
| Redhat Openshift | — | Upgrade runcUpgrade jenkins | May 21, 2021 | Apr 1, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 1, 2021 |
| Suse | — | Upgrade jetty-jndiUpgrade jetty-javax-websocket-client-implUpgrade jetty-httpUpgrade jetty-ioUpgrade jetty-webappUpgrade jetty-jaasUpgrade jetty-securityUpgrade jetty-xmlUpgrade jetty-jspUpgrade jetty-util-ajaxUpgrade jetty-websocket-commonUpgrade jetty-websocket-servletUpgrade jetty-jmxUpgrade jetty-openidUpgrade jetty-websocket-javadocUpgrade jetty-utilUpgrade jetty-plusUpgrade jetty-proxyUpgrade jetty-websocket-serverUpgrade jetty-websocket-apiUpgrade jetty-servletUpgrade jetty-clientUpgrade jetty-continuationUpgrade jetty-javax-websocket-server-implUpgrade jetty-annotationsUpgrade jetty-websocket-clientUpgrade jetty-serverUpgrade jetty-minimal-javadoc | Jun 19, 2021 | Apr 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub