Skip to main content
cve.nowby Sazabi
← Maven
MavenPackage

org.eclipse.jetty.http2:http2-common

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

Latest release
11.0.26 (Aug 14, 2025): no advisory affects it
Newest unaffected release
11.0.26 (Aug 14, 2025), the latest release
Advisories
3 · 3 high
Dependents
90
Releases
194 since 9.3.0.v20150612 (Jun 12, 2015)
Registry
Maven Central
Releases read
Nov 8, 2026

Version timeline

  • CVE-2025-5115
    Affects 9.3.0.v20150612 to 9.4.57.v20241219 (9.4.58.v20250814 is outside it); 10.0.0 to 10.0.25 (10.0.26 is outside it); 11.0.0 to 11.0.25 (11.0.26 is outside it)
  • CVE-2024-22201
    Affects 9.3.0.v20150612 to 9.4.53.v20231009 (9.4.54.v20240208 is outside it); 10.0.0 to 10.0.19 (10.0.20 is outside it); 11.0.0 to 11.0.19 (11.0.20 is outside it)
  • CVE-2023-44487
    Affects 9.3.0.v20150612 to 9.4.52.v20230823 (9.4.53.v20231009 is outside it); 10.0.0 to 10.0.16 (10.0.17 is outside it); 11.0.0 to 11.0.16 (11.0.17 is outside it)
Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

Advisories 3

  • MadeYouReset HTTP/2 vulnerability

    Affected: from 9.3.0, fixed in 9.4.58; from 10.0.0, fixed in 10.0.26; from 11.0.0, fixed in 11.0.26.

    Fixed in 9.4.58.v20250814 (released Aug 14, 2025, 6 days before disclosure, the advisory names 9.4.58, which was never published), 10.0.26 (released Aug 14, 2025, 6 days before disclosure) and 11.0.26 (released Aug 14, 2025, 6 days before disclosure).

    The latest release, 11.0.26, is not affected.

  • Jetty connection leaking on idle timeout when TCP congested

    Affected: from 9.3.0, fixed in 9.4.54; from 10.0.0, fixed in 10.0.20; from 11.0.0, fixed in 11.0.20.

    Fixed in 9.4.54.v20240208 (released Feb 8, 2024, 18 days before disclosure, the advisory names 9.4.54, which was never published), 10.0.20 (released Jan 29, 2024, 28 days before disclosure) and 11.0.20 (released Jan 29, 2024, 28 days before disclosure).

    The latest release, 11.0.26, is not affected.

  • CVE-2023-44487High 7.5 · KEV

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

    Affected: from 9.3.0, fixed in 9.4.53; from 10.0.0, fixed in 10.0.17; from 11.0.0, fixed in 11.0.17.

    Fixed in 9.4.53.v20231009 (released Oct 9, 2023, 1 day before disclosure, the advisory names 9.4.53, which was never published), 10.0.17 (released Oct 9, 2023, 1 day before disclosure) and 11.0.17 (released Oct 9, 2023, 1 day before disclosure).

    The latest release, 11.0.26, is not affected.