Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
CVSS Details
- CVSS 3.1 Base Score: 7.5
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jetty9 | Apr 8, 2024 | Feb 26, 2024 |
| Freebsd | — | Upgrade jenkinsUpgrade jenkins-lts | Dec 10, 2025 | Apr 2, 2024 |
| Jenkins 2024 03 20 | — | Upgrade Jenkins LTS to version 2.440.2Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest versionUpgrade Jenkins to version 2.444 | Mar 21, 2024 | Feb 26, 2024 |
| Redhat_linux | — | No solution exists | Jul 9, 2025 | Feb 26, 2024 |
| Suse | — | Upgrade jetty-servletsUpgrade jetty-quickstartUpgrade jetty-cdiUpgrade jetty-minimal-javadocUpgrade jetty-proxyUpgrade jetty-openidUpgrade jetty-serverUpgrade jetty-antUpgrade jetty-jspUpgrade jetty-securityUpgrade jetty-xmlUpgrade jetty-util-ajaxUpgrade jetty-utilUpgrade jetty-deployUpgrade jetty-servletUpgrade jetty-jndiUpgrade jetty-httpUpgrade jetty-plusUpgrade jetty-ioUpgrade jetty-continuationUpgrade jetty-rewriteUpgrade jetty-jaasUpgrade jetty-webappUpgrade jetty-clientUpgrade jetty-http-spiUpgrade jetty-startUpgrade jetty-jmxUpgrade jetty-fcgiUpgrade jetty-annotations | Mar 11, 2024 | Feb 26, 2024 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub