Skip to main content
cve.nowby Sazabi
← All vulnerabilities
CVE-2021-28165GHSA-26VR-8J45-3R4WBIT-JENKINS-2021-28165

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large inva

Published
Last modified
published
Not listed in CISA KEV
Fix
Fixed in 9.4.39, 10.0.2, 11.0.2
1 proof of concept on GitHub
  • Exploitation: none
  • Automatable: yes
  • Technical impact: partial

Summary

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Timeline

  1. CVE published
  2. CISA SSVC assessment

    Exploitation: none · Automatable: yes · Technical impact: partial

  3. Record last updated
  4. EPSS reached 10%

    FIRST estimates at least a 10% chance of exploitation in the next 30 days

Affected versions

  • The Eclipse Foundation Eclipse Jetty

    From 7.2.2; through 9.4.38; From 10.0.0.alpha0; through 10.0.1; From 11.0.0.alpha0; through 11.0.1

  • org.eclipse.jetty:jetty-serverMaven

    From 7.2.2 · fixed in 9.4.39

  • org.eclipse.jetty:jetty-serverMaven

    From 10.0.0 · fixed in 10.0.2

  • org.eclipse.jetty:jetty-serverMaven

    From 11.0.0 · fixed in 11.0.2

References 26

GitHub · eclipse/jetty.project

lists.apache.org

GitHub · uthrasri/CVE-2021-28165