Read the docs
TI-2022-02028 Aliases CVE-2022-2191GHSA-8mpp-f3f7-xc28

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions…

Priority LOW 37CWE-404Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 1 fixed, 5 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-404.

Summary

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

Why it matters now

EPSS 0.02178 82nd percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.eclipse.jetty:jetty-server (Maven): 10.0.10, 11.0.10Red Hat: 1 advisoryRed Hat: 1 fixed, 5 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty10.0.0 and later; up to 10.0.9; 11.0.0 and later; up to 11.0.9—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)10.0.0 to before 10.0.1010.0.10Patch availableGHSA-8mpp-f3f7-xc28
—org.eclipse.jetty:jetty-server (Maven)11.0.0 to before 11.0.1011.0.10Patch availableGHSA-8mpp-f3f7-xc28
  • Eclipse Jetty VendorEclipse Foundation Affected 10.0.0 and later; up to 10.0.9; 11.0.0 and later; up to 11.0.9 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 10.0.0 to before 10.0.10 Fixed in 10.0.10 Patch available GHSA-8mpp-f3f7-xc28
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 11.0.0 to before 11.0.10 Fixed in 11.0.10 Patch available GHSA-8mpp-f3f7-xc28

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*10.0.0 – 10.0.9; 11.0.0 – 11.0.9VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 10.0.0 – 10.0.9; 11.0.0 – 11.0.9 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-8mpp-f3f7-xc28 org.eclipse.jetty:jetty-server (Maven) Fixed in 10.0.10 Advisory →
  • Fix · GHSA-8mpp-f3f7-xc28 org.eclipse.jetty:jetty-server (Maven) Fixed in 11.0.10 Advisory →

Red Hat 1 advisory

  • RHSA-2023:0189 Released 2023-01-17 · Red Hat rating Moderate
    Red Hat AMQ Streams 2.3.0 release and security update
    • Red Hat AMQ Streams 2.3.0

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat JBoss Data Grid 7AffectedNo fix planned: Out of support scope
Red Hat JBoss Enterprise Application Platform 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse 6AffectedNo fix planned: Out of support scope
Red Hat JBoss Fuse Service Works 6AffectedNo fix planned: Out of support scope
Red Hat OpenStack Platform 13 (Queens)AffectedNo fix planned: Out of support scope
Red Hat AMQ Streams 2.3.0Fixed RHSA-2023:0189
Not affected: 16 products
  • A-MQ Clients 2
  • Red Hat AMQ Broker 7
  • Red Hat Data Grid 8
  • Red Hat Decision Manager 7
  • Red Hat Fuse 7
  • Red Hat Integration Camel K 1
  • Red Hat Integration Camel Quarkus 1
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat OpenShift Application Runtimes
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Debezium 1
  • Red Hat build of Quarkus
  • Red Hat support for Spring Boot

Timeline

  1. 2026-10-02 Threatist record created from CVE-2022-2191
  2. 2026-10-03 Alias added: GHSA-8mpp-f3f7-xc28

References

Exploit 1

Advisory 2

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences