In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.
For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.
The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.
Links:
* https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Debian | — | Upgrade jetty9Upgrade jetty12 | Sep 16, 2025 | Sep 16, 2025 |
| Freebsd | — | Upgrade jenkins-ltsUpgrade jenkins | Dec 10, 2025 | Sep 17, 2025 |
| Jenkins 2025 09 17 | — | Upgrade Jenkins LTS to version 2.516.3Upgrade Jenkins to version 2.528Upgrade Jenkins LTS to the latest versionUpgrade Jenkins to the latest version | Sep 18, 2025 | Aug 20, 2025 |
| Red Hat Jboss Eap | — | — | Oct 15, 2025 | Aug 20, 2025 |
| Suse | — | Upgrade jetty-proxyUpgrade jetty-websocket-servletUpgrade jetty-jmxUpgrade jetty-xmlUpgrade jetty-servletsUpgrade jetty-javax-websocket-server-implUpgrade jetty-quickstartUpgrade jetty-rewriteUpgrade jetty-serverUpgrade jetty-websocket-clientUpgrade jetty-util-ajaxUpgrade jetty-websocket-javadocUpgrade jetty-projectUpgrade jetty-antUpgrade jetty-openidUpgrade jetty-securityUpgrade jetty-utilUpgrade jetty-continuationUpgrade jetty-minimal-javadocUpgrade jetty-deployUpgrade jetty-jspUpgrade jetty-servletUpgrade jetty-websocket-apiUpgrade jetty-jndiUpgrade jetty-fcgiUpgrade jetty-javax-websocket-client-implUpgrade jetty-webappUpgrade jetty-cdiUpgrade jetty-websocket-serverUpgrade jetty-plusUpgrade jetty-clientUpgrade jetty-ioUpgrade jetty-http-spiUpgrade jetty-annotationsUpgrade jetty-jaasUpgrade jetty-startUpgrade jetty-websocket-commonUpgrade jetty-http | Aug 28, 2025 | Aug 27, 2025 |
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub