# org.eclipse.jetty.http2:http2-server (Maven) vulnerabilities

2 known vulnerabilities (2 high), with the versions each affects and the releases that fix them.

## At a glance

- Latest release: 11.0.26 (Aug 14, 2025): no advisory affects it
- Newest unaffected release: 11.0.26 (Aug 14, 2025), the latest release
- Dependents: 82
- Releases: 194 since 9.3.0.v20150612 (Jun 12, 2015)
- Registry: https://central.sonatype.com/artifact/org.eclipse.jetty.http2/http2-server
- Releases read: Nov 8, 2026

## Version timeline

Affected versions per advisory, in version order:

- CVE-2023-44487: 9.3.0.v20150612 to 9.4.52.v20230823 (9.4.53.v20231009 is outside it); 10.0.0 to 10.0.16 (10.0.17 is outside it); 11.0.0 to 11.0.16 (11.0.17 is outside it)
- CVE-2022-2048: 9.3.0.M0 to 9.4.46.v20220331 (9.4.47.v20220610 is outside it); 10.0.0 to 10.0.9 (10.0.10 is outside it); 11.0.0 to 11.0.9 (11.0.10 is outside it)

## Advisories (2)

### [CVE-2023-44487](https://cve.now/CVE-2023-44487): The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as

- Severity: High 7.5 · KEV
- Published: Oct 10, 2023
- Affected: from 9.3.0, fixed in 9.4.53; from 10.0.0, fixed in 10.0.17; from 11.0.0, fixed in 11.0.17.
- Fixed in 9.4.53.v20231009 (released Oct 9, 2023, 1 day before disclosure, the advisory names 9.4.53, which was never published), 10.0.17 (released Oct 9, 2023, 1 day before disclosure) and 11.0.17 (released Oct 9, 2023, 1 day before disclosure).
- The latest release, 11.0.26, is not affected.

### [CVE-2022-2048](https://cve.now/CVE-2022-2048): In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up…

- Severity: High 7.5
- Published: Jul 7, 2022
- Affected: fixed in 9.4.47; from 10.0.0, fixed in 10.0.10; from 11.0.0, fixed in 11.0.10.
- Fixed in 9.4.47.v20220610 (released Jun 10, 2022, 27 days before disclosure, the advisory names 9.4.47, which was never published), 10.0.10 (released Jun 16, 2022, 21 days before disclosure) and 11.0.10 (released Jun 16, 2022, 21 days before disclosure).
- The latest release, 11.0.26, is not affected.

---

Source: cve.now
Built by [Sazabi](https://www.sazabi.com/?utm_source=cve-now&utm_medium=markdown), AI-native observability and security: automatic issue detection, plain-language log search and live dashboards.
Page: https://cve.now/packages/maven/org.eclipse.jetty.http2:http2-server
Site guide for agents: https://cve.now/llms.txt
Uses NVD data; not endorsed by NVD.