CVE-2024-22201
High
Description
Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
SeverityHigh
CVSS7.5
Exploit probability—
Product
Eclipse Jetty
PublishedFeb 26, 2024
First seenFeb 26, 2024
Weakness typeCWE-400Uncontrolled resource consumption
How to fix
Update
- eclipse jetty9.4.54, 10.0.20, 11.0.20, 12.0.6 or later
- org.eclipse.jetty.http2:http2-common9.4.54, 10.0.20, 11.0.20 or later
- org.eclipse.jetty.http3:http3-common10.0.20, 11.0.20 or later
- org.eclipse.jetty.http2:jetty-http2-common12.0.6 or later
- org.eclipse.jetty.http3:jetty-http3-common12.0.6 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| eclipse jetty | 9.3.0 ≤ v < 9.4.54, 10.0.0 ≤ v < 10.0.20, 11.0.0 ≤ v < 11.0.20, 12.0.0 ≤ v < 12.0.6 | 9.4.54, 10.0.20, 11.0.20, 12.0.6 |
| debian debian_linux | 10.0 | — |
| netapp active_iq_unified_manager | No range specified | — |
| netapp bluexp | No range specified | — |
| org.eclipse.jetty.http2:http2-commonMaven | 9.3.0 ≤ v < 9.4.54, 10.0.0 ≤ v < 10.0.20, 11.0.0 ≤ v < 11.0.20 | 9.4.54, 10.0.20, 11.0.20 |
| org.eclipse.jetty.http3:http3-commonMaven | 10.0.8 ≤ v < 10.0.20, 11.0.8 ≤ v < 11.0.20 | 10.0.20, 11.0.20 |
| org.eclipse.jetty.http2:jetty-http2-commonMaven | 12.0.0 ≤ v < 12.0.6 | 12.0.6 |
| org.eclipse.jetty.http3:jetty-http3-commonMaven | 12.0.0 ≤ v < 12.0.6 | 12.0.6 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.