Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jetty9 | Apr 8, 2024 | Feb 26, 2024 |
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Dec 10, 2025 | Apr 2, 2024 |
| Jenkins 2024 03 20 | — | Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to version 2.444Upgrade Jenkins LTS to version 2.440.2Upgrade Jenkins to the latest version | Mar 21, 2024 | Feb 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2024 |
| Suse | — | Upgrade jetty-http-spiUpgrade jetty-clientUpgrade jetty-fcgiUpgrade jetty-webappUpgrade jetty-plusUpgrade jetty-httpUpgrade jetty-annotationsUpgrade jetty-jndiUpgrade jetty-rewriteUpgrade jetty-jaasUpgrade jetty-continuationUpgrade jetty-ioUpgrade jetty-jmxUpgrade jetty-startUpgrade jetty-xmlUpgrade jetty-securityUpgrade jetty-deployUpgrade jetty-utilUpgrade jetty-util-ajaxUpgrade jetty-servletUpgrade jetty-quickstartUpgrade jetty-servletsUpgrade jetty-serverUpgrade jetty-antUpgrade jetty-jspUpgrade jetty-cdiUpgrade jetty-proxyUpgrade jetty-minimal-javadocUpgrade jetty-openid | Mar 11, 2024 | Feb 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub