MavenPackage

org.eclipse.jetty.http2:http2-server

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

Version timeline

CVE-2023-44487
Affects 9.3.0.v20150612 to 9.4.52.v20230823 (9.4.53.v20231009 is outside it); 10.0.0 to 10.0.16 (10.0.17 is outside it); 11.0.0 to 11.0.16 (11.0.17 is outside it)
CVE-2022-2048
Affects 9.3.0.M0 to 9.4.46.v20220331 (9.4.47.v20220610 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it); 11.0.0 to 11.0.9 (11.0.10 is outside it)

Every release cve.now has on record, lowest version on the left; each bar is a run of versions an advisory affects.

CVE-2023-44487High 7.5 · KEV
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as
Affected: from 9.3.0, fixed in 9.4.53; from 10.0.0, fixed in 10.0.17; from 11.0.0, fixed in 11.0.17.
Fixed in 9.4.53.v20231009 (released Oct 9, 2023, 1 day before disclosure, the advisory names 9.4.53, which was never published), 10.0.17 (released Oct 9, 2023, 1 day before disclosure) and 11.0.17 (released Oct 9, 2023, 1 day before disclosure).
The latest release, 11.0.26, is not affected.
CVE-2022-2048High 7.5
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up…
Affected: fixed in 9.4.47; from 10.0.0, fixed in 10.0.10; from 11.0.0, fixed in 11.0.10.
Fixed in 9.4.47.v20220610 (released Jun 10, 2022, 27 days before disclosure, the advisory names 9.4.47, which was never published), 10.0.10 (released Jun 16, 2022, 21 days before disclosure) and 11.0.10 (released Jun 16, 2022, 21 days before disclosure).
The latest release, 11.0.26, is not affected.