vulnerability

Jenkins Advisory 2022-09-09: CVE-2022-2048: HTTP/2 denial of service vulnerability in bundled Jetty

Try Surface Command

Back to search

Severity

CVSS

(AV:N/AC:L/Au:N/C:N/I:N/A:P)

Published

Jul 7, 2022

Added

Sep 12, 2022

Modified

Mar 27, 2026

Description

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

Solutions

jenkins-lts-upgrade-2_361_1jenkins-upgrade-2_363

References

CVE-2022-2048
https://attackerkb.com/topics/CVE-2022-2048
CWE-410
CWE-664
EUVD-EUVD-2022-6436
https://euvd.enisa.europa.eu/vulnerability/EUVD-2022-6436
https://jenkins.io/security/advisory/2022-09-09/

Rapid7 Labs

2026 Global Threat Landscape Report

The predictive window has collapsed. Exploitation follows disclosure in days. See how attackers are accelerating and how to stay ahead.

Get report