Jetty connection leaking on idle timeout when TCP congested
Priority HIGH 66CWE-400Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Impact type
- Denial of service
- Confidentiality · integrity · availability
- None · None · High
- Fix status
- Partial Red Hat: 6 fixed, 8 without a fix
Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.
Summary
Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
Why it matters now
Exploitation Proof of concept CISA SSVC · not in CISA KEV
EPSS 0.01433 73rd percentileScored 2026-11-07
Fix Partial org.eclipse.jetty.http2:http2-common (Maven): 9.4.54, 10.0.20, 11.0.20org.eclipse.jetty.http3:http3-common (Maven): 10.0.20, 11.0.20+2 more productsRed Hat: 6 advisoriesRed Hat: 6 fixed, 8 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- Poc
- Automatable
- No
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| jetty | jetty.project | 9.3.0 – 9.4.53; 10.0.0 – 10.0.19; 11.0.0 – 11.0.19; 12.0.0 – 12.0.5 | — | No fix listed | CNA |
| — | org.eclipse.jetty.http2:http2-common (Maven) | 9.3.0 to before 9.4.54 | 9.4.54 | Patch available | GHSA-rggv-cv7r-mw98 |
| — | org.eclipse.jetty.http2:http2-common (Maven) | 10.0.0 to before 10.0.20 | 10.0.20 | Patch available | GHSA-rggv-cv7r-mw98 |
| — | org.eclipse.jetty.http3:http3-common (Maven) | 10.0.8 to before 10.0.20 | 10.0.20 | Patch available | GHSA-rggv-cv7r-mw98 |
| — | org.eclipse.jetty.http2:http2-common (Maven) | 11.0.0 to before 11.0.20 | 11.0.20 | Patch available | GHSA-rggv-cv7r-mw98 |
| — | org.eclipse.jetty.http3:http3-common (Maven) | 11.0.8 to before 11.0.20 | 11.0.20 | Patch available | GHSA-rggv-cv7r-mw98 |
| — | org.eclipse.jetty.http2:jetty-http2-common (Maven) | 12.0.0 to before 12.0.6 | 12.0.6 | Patch available | GHSA-rggv-cv7r-mw98 |
| — | org.eclipse.jetty.http3:jetty-http3-common (Maven) | 12.0.0 to before 12.0.6 | 12.0.6 | Patch available | GHSA-rggv-cv7r-mw98 |
- jetty.project Vendorjetty Affected 9.3.0 – 9.4.53; 10.0.0 – 10.0.19; 11.0.0 – 11.0.19; 12.0.0 – 12.0.5 Fixed in — No fix listed CNA
- org.eclipse.jetty.http2:http2-common (Maven) Vendor— Affected 9.3.0 to before 9.4.54 Fixed in 9.4.54 Patch available GHSA-rggv-cv7r-mw98
- org.eclipse.jetty.http2:http2-common (Maven) Vendor— Affected 10.0.0 to before 10.0.20 Fixed in 10.0.20 Patch available GHSA-rggv-cv7r-mw98
- org.eclipse.jetty.http3:http3-common (Maven) Vendor— Affected 10.0.8 to before 10.0.20 Fixed in 10.0.20 Patch available GHSA-rggv-cv7r-mw98
- org.eclipse.jetty.http2:http2-common (Maven) Vendor— Affected 11.0.0 to before 11.0.20 Fixed in 11.0.20 Patch available GHSA-rggv-cv7r-mw98
- org.eclipse.jetty.http3:http3-common (Maven) Vendor— Affected 11.0.8 to before 11.0.20 Fixed in 11.0.20 Patch available GHSA-rggv-cv7r-mw98
- org.eclipse.jetty.http2:jetty-http2-common (Maven) Vendor— Affected 12.0.0 to before 12.0.6 Fixed in 12.0.6 Patch available GHSA-rggv-cv7r-mw98
- org.eclipse.jetty.http3:jetty-http3-common (Maven) Vendor— Affected 12.0.0 to before 12.0.6 Fixed in 12.0.6 Patch available GHSA-rggv-cv7r-mw98
CPE configurations NVD · 5
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | 9.3.0 to before 9.4.54; 10.0.0 to before 10.0.20; 11.0.0 to before 11.0.20; 12.0.0 to before 12.0.6 | Vulnerable | Eclipse Foundation |
| cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* | 10.0 | Vulnerable | Debian |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* | not specified by NVD | Vulnerable | NetApp |
| cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:* | not specified by NVD | Vulnerable | NetApp |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.3.0 to before 9.4.54; 10.0.0 to before 10.0.20; 11.0.0 to before 11.0.20; 12.0.0 to before 12.0.6 Vulnerable ·Eclipse Foundation
- cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* Versions 10.0 Vulnerable ·Debian
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* Versions not specified by NVD Vulnerable ·NetApp
- cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:* Versions not specified by NVD Vulnerable ·NetApp
Remediation
- Fix · GHSA-rggv-cv7r-mw98 org.eclipse.jetty.http2:http2-common (Maven) Fixed in 9.4.54 Advisory →
- Fix · GHSA-rggv-cv7r-mw98 org.eclipse.jetty.http2:http2-common (Maven) Fixed in 10.0.20 Advisory →
- Fix · GHSA-rggv-cv7r-mw98 org.eclipse.jetty.http3:http3-common (Maven) Fixed in 10.0.20 Advisory →
- Fix · GHSA-rggv-cv7r-mw98 org.eclipse.jetty.http2:http2-common (Maven) Fixed in 11.0.20 Advisory →
- Fix · GHSA-rggv-cv7r-mw98 org.eclipse.jetty.http3:http3-common (Maven) Fixed in 11.0.20 Advisory →
- Fix · GHSA-rggv-cv7r-mw98 org.eclipse.jetty.http2:jetty-http2-common (Maven) Fixed in 12.0.6 Advisory →
- Fix · GHSA-rggv-cv7r-mw98 org.eclipse.jetty.http3:jetty-http3-common (Maven) Fixed in 12.0.6 Advisory →
Red Hat 6 advisories
- RHSA-2024:4884 Released 2024-07-25 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.4.1 for Spring Boot security update.
- Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2
- RHSA-2024:4873 Released 2024-07-25 · Red Hat rating ImportantApicurio Registry (container images) release and security update [ 2.6.1 GA ]
- Red Hat build of Apicurio Registry 2.6.1 GA
- RHSA-2024:4597 Released 2024-07-17 · Red Hat rating ImportantRed Hat Product OCP Tools 4.15 OpenShift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1718879538-1.el8, jenkins-2.440.3.1718879390-3.el8
Show 3 more Red Hat advisories
- RHSA-2024:3635 Released 2024-06-05 · Red Hat rating ImportantRed Hat Product OCP Tools 4.12 Openshift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1716445211-1.el8, jenkins-2.440.3.1716445200-3.el8
- RHSA-2024:3634 Released 2024-06-05 · Red Hat rating ImportantRed Hat Product OCP Tools 4.14 OpenShift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1716388016-1.el8, jenkins-2.440.3.1716387933-3.el8
- RHSA-2024:3636 Released 2024-06-05 · Red Hat rating ImportantRed Hat Product OCP Tools 4.13 OpenShift Jenkins security update
- OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1716445207-1.el8, jenkins-2.440.3.1716445150-3.el8
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| Red Hat Enterprise Linux 7 | Affected | No fix planned: Out of support scope |
| Red Hat Fuse 7 | Affected | No fix yet |
| Red Hat Integration Camel K 1 | Affected | No fix planned: Will not fix |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Affected | No fix yet |
| Red Hat OpenShift Container Platform 3.11 | Affected | No fix planned: Out of support scope |
| Red Hat Process Automation 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel for Spring Boot 3 | Affected | No fix planned: Out of support scope |
| streams for Apache Kafka | Affected | No fix planned: Will not fix |
| OpenShift Developer Tools and Services for OCP 4.12 | Fixed | RHSA-2024:3635 |
| OpenShift Developer Tools and Services for OCP 4.13 | Fixed | RHSA-2024:3636 |
| OpenShift Developer Tools and Services for OCP 4.14 | Fixed | RHSA-2024:3634 |
| OpenShift Developer Tools and Services for OCP 4.15 | Fixed | RHSA-2024:4597 |
| Red Hat build of Apache Camel 4.4.1 for Spring Boot 3.2 | Fixed | RHSA-2024:4884 |
| Red Hat build of Apicurio Registry 2.6.1 GA | Fixed | RHSA-2024:4873 |
Not affected: 7 products
- OpenShift Serverless
- Red Hat Data Grid 8
- Red Hat Integration Camel Quarkus 2
- Red Hat JBoss Data Grid 7
- Red Hat JBoss Enterprise Application Platform 7
- Red Hat JBoss Enterprise Application Platform 8
- Red Hat build of Apache Camel 4 for Quarkus 3
Timeline
- 2026-10-02 Threatist record created from CVE-2024-22201
- 2026-10-03 Alias added: GHSA-rggv-cv7r-mw98
References
Advisory 4
Other 7
- https://github.com/jetty/jetty.project/issues/11256
- https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html
- https://github.com/jetty/jetty.project/issues/11259
- https://github.com/jetty/jetty.project/commit/0839a208cdc3fcfe25206a77af59ba9fda260188
- https://github.com/jetty/jetty.project/commit/b953871c9a5ff4fbca4a2499848f75182dbd9810
- https://github.com/jetty/jetty.project
- https://security.netapp.com/advisory/ntap-20240329-0001
More jetty vulnerabilities
- TI-2004-02348 Unspecified vulnerability in Jetty HTTP Server, as used in (1) IBM Trading Partner… CVSS 2.0HIGH 7.5
- TI-2002-01139 Directory traversal vulnerability in the CGIServlet for Jetty HTTP server before 4.1.0… CVSS 2.0MEDIUM 5.0
- TI-2006-06711 Jetty before 4.2.27, 5.1 before 5.1.12, 6.0 before 6.0.2, and 6.1 before 6.1.0pre3… CVSS 2.0MEDIUM 6.8
- TI-2002-01455 Cross-site scripting (XSS) vulnerability in Jetty JSP servlet engine allows remote… CVSS 2.0MEDIUM 5.8
- TI-2006-02666 Directory traversal vulnerability in jetty 6.0.x (jetty6) beta16 allows remote attackers… CVSS 2.0MEDIUM 5.0
- TI-2006-02667 jetty 6.0.x (jetty6) beta16 allows remote attackers to read arbitrary script source code… CVSS 2.0MEDIUM 5.0
Sources
- CVE-2024-22201 · CVE Program
- CVE-2024-22201 · NVD
- FIRST EPSS
- GHSA-rggv-cv7r-mw98 · GitHub Advisory Database · CC BY 4.0
- CVE-2024-22201 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences