The Quarterly Threat Landscape Report is out. See what attackers are targeting now.Read report
Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jetty9 | Apr 8, 2024 | Feb 26, 2024 |
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Dec 10, 2025 | Apr 2, 2024 |
| Jenkins 2024 03 20 | — | Upgrade Jenkins LTS to version 2.440.2Upgrade Jenkins to version 2.444Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest version | Mar 21, 2024 | Feb 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2024 |
| Suse | — | Upgrade jetty-deployUpgrade jetty-servletUpgrade jetty-utilUpgrade jetty-servletsUpgrade jetty-serverUpgrade jetty-antUpgrade jetty-util-ajaxUpgrade jetty-minimal-javadocUpgrade jetty-quickstartUpgrade jetty-openidUpgrade jetty-cdiUpgrade jetty-proxyUpgrade jetty-securityUpgrade jetty-xmlUpgrade jetty-jspUpgrade jetty-clientUpgrade jetty-jaasUpgrade jetty-plusUpgrade jetty-fcgiUpgrade jetty-rewriteUpgrade jetty-webappUpgrade jetty-httpUpgrade jetty-jndiUpgrade jetty-continuationUpgrade jetty-http-spiUpgrade jetty-annotationsUpgrade jetty-ioUpgrade jetty-startUpgrade jetty-jmx | Mar 11, 2024 | Feb 26, 2024 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub