# org.eclipse.jetty.http2:http2-common (Maven) vulnerabilities

3 known vulnerabilities (3 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 11.0.26 (Aug 14, 2025): no advisory affects it
- Newest unaffected release: 11.0.26 (Aug 14, 2025), the latest release
- Dependents: 90
- Releases: 194 since 9.3.0.v20150612 (Jun 12, 2015)
- Registry: https://central.sonatype.com/artifact/org.eclipse.jetty.http2/http2-common
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2025-5115: 9.3.0.v20150612 to 9.4.57.v20241219 (9.4.58.v20250814 is outside it); 10.0.0 to 10.0.25 (10.0.26 is outside it); 11.0.0 to 11.0.25 (11.0.26 is outside it)
- CVE-2024-22201: 9.3.0.v20150612 to 9.4.53.v20231009 (9.4.54.v20240208 is outside it); 10.0.0 to 10.0.19 (10.0.20 is outside it); 11.0.0 to 11.0.19 (11.0.20 is outside it)
- CVE-2023-44487: 9.3.0.v20150612 to 9.4.52.v20230823 (9.4.53.v20231009 is outside it); 10.0.0 to 10.0.16 (10.0.17 is outside it); 11.0.0 to 11.0.16 (11.0.17 is outside it)

## Advisories (3)

### [CVE-2025-5115](https://cve.now/CVE-2025-5115): MadeYouReset HTTP/2 vulnerability

- Severity: High 7.7
- Published: Aug 20, 2025
- Affected: from 9.3.0, fixed in 9.4.58; from 10.0.0, fixed in 10.0.26; from 11.0.0, fixed in 11.0.26.
- Fixed in 9.4.58.v20250814 (released Aug 14, 2025, 6 days before disclosure, the advisory names 9.4.58, which was never published), 10.0.26 (released Aug 14, 2025, 6 days before disclosure) and 11.0.26 (released Aug 14, 2025, 6 days before disclosure).
- The latest release, 11.0.26, is not affected.

### [CVE-2024-22201](https://cve.now/CVE-2024-22201): Jetty connection leaking on idle timeout when TCP congested

- Severity: High 7.5
- Published: Feb 26, 2024
- Affected: from 9.3.0, fixed in 9.4.54; from 10.0.0, fixed in 10.0.20; from 11.0.0, fixed in 11.0.20.
- Fixed in 9.4.54.v20240208 (released Feb 8, 2024, 18 days before disclosure, the advisory names 9.4.54, which was never published), 10.0.20 (released Jan 29, 2024, 28 days before disclosure) and 11.0.20 (released Jan 29, 2024, 28 days before disclosure).
- The latest release, 11.0.26, is not affected.

### [CVE-2023-44487](https://cve.now/CVE-2023-44487): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

- Severity: High 7.5 · KEV
- Published: Oct 10, 2023
- Affected: from 9.3.0, fixed in 9.4.53; from 10.0.0, fixed in 10.0.17; from 11.0.0, fixed in 11.0.17.
- Fixed in 9.4.53.v20231009 (released Oct 9, 2023, 1 day before disclosure, the advisory names 9.4.53, which was never published), 10.0.17 (released Oct 9, 2023, 1 day before disclosure) and 11.0.17 (released Oct 9, 2023, 1 day before disclosure).
- The latest release, 11.0.26, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.eclipse.jetty.http2:http2-common
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.