Read the docs
TI-2021-09394 Aliases CVE-2021-28165GHSA-26vr-8j45-3r4w

Uncontrolled resource consumption in Eclipse Jetty

Priority HIGH 71CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 10 fixed, 9 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.53861 99th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.eclipse.jetty:jetty-server (Maven): 9.4.39, 10.0.2, 11.0.2Red Hat: 9 advisoriesRed Hat: 10 fixed, 9 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty7.2.2 and later; up to 9.4.38; 10.0.0.alpha0 and later; up to 10.0.1; 11.0.0.alpha0 and later; up to 11.0.1—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)7.2.2 to before 9.4.399.4.39Patch availableGHSA-26vr-8j45-3r4w
—org.eclipse.jetty:jetty-server (Maven)10.0.0 to before 10.0.210.0.2Patch availableGHSA-26vr-8j45-3r4w
—org.eclipse.jetty:jetty-server (Maven)11.0.0 to before 11.0.211.0.2Patch availableGHSA-26vr-8j45-3r4w
  • Eclipse Jetty VendorEclipse Foundation Affected 7.2.2 and later; up to 9.4.38; 10.0.0.alpha0 and later; up to 10.0.1; 11.0.0.alpha0 and later; up to 11.0.1 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 7.2.2 to before 9.4.39 Fixed in 9.4.39 Patch available GHSA-26vr-8j45-3r4w
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 10.0.0 to before 10.0.2 Fixed in 10.0.2 Patch available GHSA-26vr-8j45-3r4w
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 11.0.0 to before 11.0.2 Fixed in 11.0.2 Patch available GHSA-26vr-8j45-3r4w

CPE configurations NVD · 22

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*7.2.2 to before 9.4.39; 10.0.0 to before 10.0.2; 11.0.0 to before 11.0.2VulnerableEclipse Foundation
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*21.0.2VulnerableOracle
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*1.14.0VulnerableOracle
cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:*8.2.2VulnerableOracle
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*7.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:*8.0.0.0 – 8.2.4.0VulnerableOracle
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:*8.0.0.0 – 8.2.4.0VulnerableOracle
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:*:*:*:*before 21.3VulnerableOracle
cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:*up to 21.9VulnerableOracle
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:*before 2.277.3VulnerableJenkins
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 7.2.2 to before 9.4.39; 10.0.0 to before 10.0.2; 11.0.0 to before 11.0.2 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:* Versions 21.0.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* Versions 1.14.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:* Versions 8.2.2 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* Versions 8.0.0.0 – 8.2.4.0 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:rest_data_services:*:*:*:*:*:*:*:* Versions before 21.3 Vulnerable ·Oracle
  • cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:* Versions up to 21.9 Vulnerable ·Oracle
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* Versions before 2.277.3 Vulnerable ·Jenkins
Show 12 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:*before 2.286VulnerableJenkins
cpe:2.3:a:netapp:cloud_manager:*:*:*:*:*:*:*:*before 3.9.8VulnerableNetApp
cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:*before 3.0VulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:*11.0.0 to before 11.70.1VulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_storage:*:*:*:*:*:vcenter:*:*before 1.10VulnerableNetApp
cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:*before 5.1VulnerableNetApp
cpe:2.3:a:netapp:ontap_tools:*:*:*:*:*:vmware_vsphere:*:*before 9.10VulnerableNetApp
cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:santricity_web_services_proxy:*:*:*:*:*:*:*:*before 5.1VulnerableNetApp
cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:*before 4.6VulnerableNetApp
cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:*before 9.10VulnerableNetApp
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:*before 9.10VulnerableNetApp
  • cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* Versions before 2.286 Vulnerable ·Jenkins
  • cpe:2.3:a:netapp:cloud_manager:*:*:*:*:*:*:*:* Versions before 3.9.8 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:* Versions before 3.0 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* Versions 11.0.0 to before 11.70.1 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_storage:*:*:*:*:*:vcenter:*:* Versions before 1.10 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:* Versions before 5.1 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:ontap_tools:*:*:*:*:*:vmware_vsphere:*:* Versions before 9.10 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:santricity_web_services_proxy:*:*:*:*:*:*:*:* Versions before 5.1 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:* Versions before 4.6 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:* Versions before 9.10 Vulnerable ·NetApp
  • cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:* Versions before 9.10 Vulnerable ·NetApp

Remediation

  • Fix · GHSA-26vr-8j45-3r4w org.eclipse.jetty:jetty-server (Maven) Fixed in 9.4.39 Advisory →
  • Fix · GHSA-26vr-8j45-3r4w org.eclipse.jetty:jetty-server (Maven) Fixed in 10.0.2 Advisory →
  • Fix · GHSA-26vr-8j45-3r4w org.eclipse.jetty:jetty-server (Maven) Fixed in 11.0.2 Advisory →

Red Hat 9 advisories

  • RHSA-2022:6407 Released 2022-09-09 · Red Hat rating Moderate
    Red Hat Integration Camel-K 1.8 security update
    • RHAF Camel-K 1.8
  • RHSA-2021:4767 Released 2021-11-23 · Red Hat rating Moderate
    Red Hat Integration Camel Extensions for Quarkus GA security update
    • Red Hat Integration Camel Quarkus 2
  • RHSA-2021:3700 Released 2021-09-30 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.9.0 release and security update
    • Red Hat AMQ 7.9.0
Show 6 more Red Hat advisories
  • RHSA-2021:3225 Released 2021-08-19 · Red Hat rating Moderate
    Red Hat AMQ Streams 1.8.0 release and security update
    • Red Hat AMQ Streams 1.8.0
  • RHSA-2021:3140 Released 2021-08-11 · Red Hat rating Moderate
    Red Hat Fuse 7.9.0 release and security update
    • Red Hat Fuse 7.9
  • RHSA-2021:2689 Released 2021-07-12 · Red Hat rating Moderate
    Red Hat AMQ Broker 7.8.2 release and security update
    • Red Hat AMQ 7.8.2
  • RHSA-2021:1551 Released 2021-05-19 · Red Hat rating Moderate
    OpenShift Container Platform 4.7.11 security and bug fix update
    • Red Hat OpenShift Container Platform 4.7 cri-tools-1.20.0-2.el7, cri-tools-1.20.0-2.el8, jenkins-2.277.3.1620393611-1.el8 +2
  • RHSA-2021:1560 Released 2021-05-13 · Red Hat rating Moderate
    Red Hat AMQ Streams 1.6.4 release and security update
    • Red Hat AMQ Streams 1.6.4
  • RHSA-2021:1509 Released 2021-05-06 · Red Hat rating Moderate
    rh-eclipse-jetty security update
    • Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7) rh-eclipse-jetty-9.4.40-1.1.el7_9, rh-eclipse-jetty-client-9.4.40-1.1.el7_9, rh-eclipse-jetty-continuation-9.4.40-1.1.el7_9 +12
    • Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7) rh-eclipse-jetty-9.4.40-1.1.el7_9, rh-eclipse-jetty-client-9.4.40-1.1.el7_9, rh-eclipse-jetty-continuation-9.4.40-1.1.el7_9 +12

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Release ·

    The Eclipse Foundation Eclipse Jetty unspecified

    3 records Highest priority Priority HIGH 2 HIGH, 1 LOW

    Other records, highest priority first

    • TI-2021-09393 Information disclosure in Eclipse JettyPriority HIGH 65
    • TI-2021-09392 Information disclosure in Eclipse JettyPriority LOW 21
    Show all 3 records →

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Enterprise Linux 7AffectedNo fix planned: Out of support scope
Red Hat Enterprise Linux 8AffectedNo fix planned: Will not fix
Red Hat Integration Camel Quarkus 1AffectedNo fix yet
Red Hat Integration Service RegistryAffectedNo fix yet
Red Hat JBoss A-MQ 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat OpenShift Container Platform 3.11AffectedNo fix yet
Red Hat OpenShift Container Platform 4AffectedNo fix planned: Will not fix
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Will not fix
RHAF Camel-K 1.8Fixed RHSA-2022:6407
Red Hat AMQ 7.8.2Fixed RHSA-2021:2689
Red Hat AMQ 7.9.0Fixed RHSA-2021:3700
Red Hat AMQ Streams 1.6.4Fixed RHSA-2021:1560
Red Hat AMQ Streams 1.8.0Fixed RHSA-2021:3225
Red Hat Developer Tools for Red Hat Enterprise Linux Server (v. 7)Fixed RHSA-2021:1509
Red Hat Developer Tools for Red Hat Enterprise Linux Workstation (v. 7)Fixed RHSA-2021:1509
Red Hat Fuse 7.9Fixed RHSA-2021:3140
Red Hat Integration Camel Quarkus 2Fixed RHSA-2021:4767
Red Hat OpenShift Container Platform 4.7Fixed RHSA-2021:1551
Not affected: 1 product
  • Red Hat OpenShift Container Platform 4.7

Timeline

  1. 2026-10-02 Threatist record created from CVE-2021-28165
  2. 2026-10-03 Alias added: GHSA-26vr-8j45-3r4w
  3. 2026-10-23 EPSS moved to the 99th percentile and above
  4. 2026-10-25 EPSS moved to the 95th–99th percentile
  5. 2026-10-31 EPSS moved to the 99th percentile and above

References

Exploit 1

Patch 3

Advisory 5

Other 200

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
  • TI-2024-14794 Jetty connection leaking on idle timeout when TCP congested CVSS 3.1HIGH 7.5
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences