Read the docs
TI-2022-01896 Aliases CVE-2022-2047GHSA-cj7v-27pg-wf7q

Improper input validation in Eclipse Jetty

Priority LOW 16CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
High
User interaction
None
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · Low · None
Fix status
Partial Red Hat: 2 fixed, 9 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat.

Summary

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

Why it matters now

EPSS 0.01324 71st percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-http (Maven): 9.4.47, 10.0.10, 11.0.10Red Hat: 2 advisoriesRed Hat: 2 fixed, 9 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty9.4.0 and later; up to 9.4.46; 10.0.0 and later; up to 10.0.9; 11.0.0 and later; up to 11.0.9—No fix listedCNA
—org.eclipse.jetty:jetty-http (Maven)before 9.4.479.4.47Patch availableGHSA-cj7v-27pg-wf7q
—org.eclipse.jetty:jetty-http (Maven)10.0.0 to before 10.0.1010.0.10Patch availableGHSA-cj7v-27pg-wf7q
—org.eclipse.jetty:jetty-http (Maven)11.0.0 to before 11.0.1011.0.10Patch availableGHSA-cj7v-27pg-wf7q
  • Eclipse Jetty VendorEclipse Foundation Affected 9.4.0 and later; up to 9.4.46; 10.0.0 and later; up to 10.0.9; 11.0.0 and later; up to 11.0.9 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected before 9.4.47 Fixed in 9.4.47 Patch available GHSA-cj7v-27pg-wf7q
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 10.0.0 to before 10.0.10 Fixed in 10.0.10 Patch available GHSA-cj7v-27pg-wf7q
  • org.eclipse.jetty:jetty-http (Maven) Vendor— Affected 11.0.0 to before 11.0.10 Fixed in 11.0.10 Patch available GHSA-cj7v-27pg-wf7q

CPE configurations NVD · 8

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*before 9.4.46; 10.0.0 to before 10.0.9; 11.0.0 – 11.0.9VulnerableEclipse Foundation
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*10.0VulnerableDebian
cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:*11.0VulnerableDebian
cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:*not specified by NVDVulnerableNetApp
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions before 9.4.46; 10.0.0 to before 10.0.9; 11.0.0 – 11.0.9 Vulnerable ·Eclipse Foundation
  • cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
  • cpe:2.3:o:debian:debian_linux:11.0:*:*:*:*:*:*:* Versions 11.0 Vulnerable ·Debian
  • cpe:2.3:a:netapp:element_plug-in_for_vcenter_server:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:management_services_for_element_software_and_netapp_hci:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:snapcenter:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:a:netapp:solidfire_\&_hci_storage_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
  • cpe:2.3:h:netapp:hci_compute_node:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp

Remediation

  • Fix · GHSA-cj7v-27pg-wf7q org.eclipse.jetty:jetty-http (Maven) Fixed in 9.4.47 Advisory →
  • Fix · GHSA-cj7v-27pg-wf7q org.eclipse.jetty:jetty-http (Maven) Fixed in 10.0.10 Advisory →
  • Fix · GHSA-cj7v-27pg-wf7q org.eclipse.jetty:jetty-http (Maven) Fixed in 11.0.10 Advisory →

Red Hat 2 advisories

  • RHSA-2023:1661 Released 2023-04-05 · Red Hat rating Important
    Red Hat AMQ Broker 7.11.0 release and security update
    • AMQ Broker 7.11.0
  • RHSA-2023:0189 Released 2023-01-17 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.3.0 release and security update
    • Red Hat AMQ Streams 2.3.0

Fixed in the same release

Records fixed by the same vendor advisory or release, as the CNA lists them.

  • Advisory ·

    The Eclipse Foundation Eclipse Jetty — DSA-5198

    2 records Highest priority Priority LOW 2 LOW

    Other records, highest priority first

    • TI-2022-01897 Uncontrolled resource consumption in Eclipse JettyPriority LOW 38
    Show all 2 records → Advisory →

Vendor assessments

Red Hat

Red Hat rating: Low. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
Red Hat Decision Manager 7AffectedNo fix planned: Out of support scope
Red Hat Integration Service RegistryAffectedNo fix planned: Out of support scope
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat Process Automation 7AffectedNo fix planned: Out of support scope
AMQ Broker 7.11.0Fixed RHSA-2023:1661
Red Hat AMQ Streams 2.3.0Fixed RHSA-2023:0189
Not affected: 12 products
  • A-MQ Clients 2
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Application Runtimes
  • Red Hat Satellite 6
  • Red Hat build of Debezium 1
  • Red Hat build of Quarkus
  • Red Hat support for Spring Boot

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2047
  2. 2026-10-03 Alias added: GHSA-cj7v-27pg-wf7q

References

Patch 1

Advisory 4

Other 2

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences