Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jetty9 | Apr 8, 2024 | Feb 26, 2024 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Dec 10, 2025 | Apr 2, 2024 |
| Jenkins 2024 03 20 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins LTS to version 2.440.2Upgrade Jenkins to the latest versionUpgrade Jenkins to version 2.444 | Mar 21, 2024 | Feb 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2024 |
| Suse | — | Upgrade jetty-deployUpgrade jetty-cdiUpgrade jetty-jspUpgrade jetty-minimal-javadocUpgrade jetty-proxyUpgrade jetty-serverUpgrade jetty-securityUpgrade jetty-openidUpgrade jetty-util-ajaxUpgrade jetty-servletUpgrade jetty-servletsUpgrade jetty-utilUpgrade jetty-quickstartUpgrade jetty-antUpgrade jetty-xmlUpgrade jetty-rewriteUpgrade jetty-http-spiUpgrade jetty-startUpgrade jetty-fcgiUpgrade jetty-webappUpgrade jetty-jndiUpgrade jetty-annotationsUpgrade jetty-clientUpgrade jetty-httpUpgrade jetty-plusUpgrade jetty-jaasUpgrade jetty-ioUpgrade jetty-continuationUpgrade jetty-jmx | Mar 11, 2024 | Feb 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub