7.5
High
CVE-2022-2048 In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug…
Description
In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.
Affected products and versions
| Product | Affected versions | Fixed in |
|---|---|---|
| Eclipse Jetty 11.0 | earliest → latest | No fix stated |
| Eclipse Jetty 10.0 | earliest → latest | No fix stated |
| Eclipse Jetty 9.4 | earliest → latest | No fix stated |
Other CVEs of Eclipse Jetty
The 23 CVEs of Eclipse Jetty →
CVE-2022-2191
In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release…
7.5
High
CVE-2022-2047
In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the…
2.7
Low
CVE-2021-34429
For Eclipse Jetty versions 9.4.37-9.4.42, 10.0.1-10.0.5 & 11.0.1-11.0.5, URIs can be crafted using some encoded…
5.3
Medium
CVE-2021-34428
For Eclipse Jetty…
2.9
Low