In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Amazon Linux Ami 2 | — | Upgrade jetty-websocket-parentUpgrade jetty-servletsUpgrade jetty-jaasUpgrade jetty-runnerUpgrade jetty-websocket-clientUpgrade jetty-proxyUpgrade jetty-xmlUpgrade jetty-websocket-apiUpgrade jetty-websocket-commonUpgrade jetty-deployUpgrade jetty-websocket-servletUpgrade jetty-javadocUpgrade jetty-jmxUpgrade jetty-rewriteUpgrade jetty-servletUpgrade jetty-continuationUpgrade jetty-jspUpgrade jetty-antUpgrade jetty-monitorUpgrade jetty-startUpgrade jetty-maven-pluginUpgrade jetty-clientUpgrade jetty-webappUpgrade jetty-utilUpgrade jetty-util-ajaxUpgrade jetty-jaspiUpgrade jetty-jndiUpgrade jetty-annotationsUpgrade jetty-jspc-maven-pluginUpgrade jetty-ioUpgrade jetty-serverUpgrade jetty-projectUpgrade jetty-plusUpgrade jetty-websocket-serverUpgrade jetty-httpUpgrade jetty-security | May 30, 2025 | Apr 1, 2021 |
| Atlassian Jira | — | Upgrade to the latest version of Atlassian JIRA | May 15, 2025 | Nov 21, 2023 |
| Debian | — | Upgrade jetty9 | Aug 6, 2021 | Apr 1, 2021 |
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Nov 4, 2022 | Apr 20, 2021 |
| Jenkins 2021 04 20 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.277.3Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.286 | Dec 2, 2021 | Apr 1, 2021 |
| Redhat Openshift | — | Upgrade jenkinsUpgrade runc | May 21, 2021 | Apr 1, 2021 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Apr 1, 2021 |
| Suse | — | Upgrade jetty-javax-websocket-client-implUpgrade jetty-httpUpgrade jetty-jspUpgrade jetty-ioUpgrade jetty-jndiUpgrade jetty-jaasUpgrade jetty-securityUpgrade jetty-webappUpgrade jetty-util-ajaxUpgrade jetty-xmlUpgrade jetty-websocket-servletUpgrade jetty-websocket-commonUpgrade jetty-proxyUpgrade jetty-utilUpgrade jetty-annotationsUpgrade jetty-plusUpgrade jetty-websocket-serverUpgrade jetty-serverUpgrade jetty-jmxUpgrade jetty-clientUpgrade jetty-javax-websocket-server-implUpgrade jetty-websocket-javadocUpgrade jetty-servletUpgrade jetty-minimal-javadocUpgrade jetty-websocket-clientUpgrade jetty-openidUpgrade jetty-websocket-apiUpgrade jetty-continuation | Jun 19, 2021 | Apr 1, 2021 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub