Read the docs
TI-2025-04585 Aliases CVE-2025-5115GHSA-mmxm-8w33-wc4h

MadeYouReset HTTP/2 vulnerability

Priority MEDIUM 46CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Attack requirements
None
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · None
Fix status
Partial Red Hat: 11 fixed, 8 without a fix

Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory. For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time. The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame. Links: * https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.03566 89th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty.http2:http2-common (Maven): 9.4.58, 10.0.26, 11.0.26org.eclipse.jetty.http2:jetty-http2-common (Maven): 12.0.25, 12.1.0.beta3Red Hat: 11 advisoriesRed Hat: 11 fixed, 8 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse JettyEclipse Jetty>=9.3.0 – <=9.4.57; >=10.0.0 – <=10.0.25; >=11.0.0 – <=11.0.25; >=12.0.0 – <=12.0.21; >=12.1.0.alpha0 – <=12.1.0.alpha2—No fix listedCNA
—org.eclipse.jetty.http2:http2-common (Maven)9.3.0 to before 9.4.589.4.58Patch availableGHSA-mmxm-8w33-wc4h
—org.eclipse.jetty.http2:http2-common (Maven)10.0.0 to before 10.0.2610.0.26Patch availableGHSA-mmxm-8w33-wc4h
—org.eclipse.jetty.http2:http2-common (Maven)11.0.0 to before 11.0.2611.0.26Patch availableGHSA-mmxm-8w33-wc4h
—org.eclipse.jetty.http2:jetty-http2-common (Maven)12.0.0 to before 12.0.2512.0.25Patch availableGHSA-mmxm-8w33-wc4h
—org.eclipse.jetty.http2:jetty-http2-common (Maven)12.1.0.alpha0 to before 12.1.0.beta312.1.0.beta3Patch availableGHSA-mmxm-8w33-wc4h
  • Eclipse Jetty VendorEclipse Jetty Affected >=9.3.0 – <=9.4.57; >=10.0.0 – <=10.0.25; >=11.0.0 – <=11.0.25; >=12.0.0 – <=12.0.21; >=12.1.0.alpha0 – <=12.1.0.alpha2 Fixed in — No fix listed CNA
  • org.eclipse.jetty.http2:http2-common (Maven) Vendor— Affected 9.3.0 to before 9.4.58 Fixed in 9.4.58 Patch available GHSA-mmxm-8w33-wc4h
  • org.eclipse.jetty.http2:http2-common (Maven) Vendor— Affected 10.0.0 to before 10.0.26 Fixed in 10.0.26 Patch available GHSA-mmxm-8w33-wc4h
  • org.eclipse.jetty.http2:http2-common (Maven) Vendor— Affected 11.0.0 to before 11.0.26 Fixed in 11.0.26 Patch available GHSA-mmxm-8w33-wc4h
  • org.eclipse.jetty.http2:jetty-http2-common (Maven) Vendor— Affected 12.0.0 to before 12.0.25 Fixed in 12.0.25 Patch available GHSA-mmxm-8w33-wc4h
  • org.eclipse.jetty.http2:jetty-http2-common (Maven) Vendor— Affected 12.1.0.alpha0 to before 12.1.0.beta3 Fixed in 12.1.0.beta3 Patch available GHSA-mmxm-8w33-wc4h

CPE configurations NVD · 4

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*9.3.0 – 9.4.57; 10.0.0 – 10.0.25; 11.0.0 – 11.0.25; 12.0.0 – 12.0.21VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.1.0:alpha0:*:*:*:*:*:*12.1.0 alpha0VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.1.0:alpha1:*:*:*:*:*:*12.1.0 alpha1VulnerableEclipse Foundation
cpe:2.3:a:eclipse:jetty:12.1.0:alpha2:*:*:*:*:*:*12.1.0 alpha2VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 9.3.0 – 9.4.57; 10.0.0 – 10.0.25; 11.0.0 – 11.0.25; 12.0.0 – 12.0.21 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.1.0:alpha0:*:*:*:*:*:* Versions 12.1.0 alpha0 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.1.0:alpha1:*:*:*:*:*:* Versions 12.1.0 alpha1 Vulnerable ·Eclipse Foundation
  • cpe:2.3:a:eclipse:jetty:12.1.0:alpha2:*:*:*:*:*:* Versions 12.1.0 alpha2 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-mmxm-8w33-wc4h org.eclipse.jetty.http2:http2-common (Maven) Fixed in 9.4.58 Advisory →
  • Fix · GHSA-mmxm-8w33-wc4h org.eclipse.jetty.http2:http2-common (Maven) Fixed in 10.0.26 Advisory →
  • Fix · GHSA-mmxm-8w33-wc4h org.eclipse.jetty.http2:http2-common (Maven) Fixed in 11.0.26 Advisory →
  • Fix · GHSA-mmxm-8w33-wc4h org.eclipse.jetty.http2:jetty-http2-common (Maven) Fixed in 12.0.25 Advisory →
  • Fix · GHSA-mmxm-8w33-wc4h org.eclipse.jetty.http2:jetty-http2-common (Maven) Fixed in 12.1.0.beta3 Advisory →

Red Hat 11 advisories

  • RHSA-2025:17567 Released 2025-10-08 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.2 release and security update
    • Red Hat AMQ Broker 7.13.2
  • RHSA-2025:16989 Released 2025-09-29 · Red Hat rating Important
    Red Hat Offline Knowledge Portal update
    • Red Hat Offline Knowledge Portal 1.1.2 registry.redhat.io/offline-knowledge-portal/rhokp-rhel9
  • RHSA-2025:16461 Released 2025-09-23 · Red Hat rating Important
    Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1758302383-1.el8, jenkins-2.516.3.1758302106-3.el8
Show 8 more Red Hat advisories
  • RHSA-2025:16462 Released 2025-09-23 · Red Hat rating Important
    Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1758303157-1.el8, jenkins-2.516.3.1758302665-3.el8
  • RHSA-2025:16460 Released 2025-09-23 · Red Hat rating Important
    Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1758299004-1.el8, jenkins-2.516.3.1758298953-3.el8
  • RHSA-2025:16459 Released 2025-09-23 · Red Hat rating Important
    Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1758299735-1.el8, jenkins-2.516.3.1758299374-3.el8
  • RHSA-2025:16457 Released 2025-09-23 · Red Hat rating Important
    Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.16 jenkins-2-plugins-4.16.1758337173-1.el9, jenkins-2.516.3.1758336945-3.el9
  • RHSA-2025:16456 Released 2025-09-23 · Red Hat rating Important
    Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.17 jenkins-2-plugins-4.17.1758260106-1.el9, jenkins-2.516.3.1758259817-3.el9
  • RHSA-2025:16454 Released 2025-09-23 · Red Hat rating Important
    Red Hat Product OCP Tools 4.19 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.19 jenkins-2-plugins-4.19.1758207171-1.el9, jenkins-2.516.3.1758206866-3.el9
  • RHSA-2025:16455 Released 2025-09-23 · Red Hat rating Important
    Red Hat Product OCP Tools 4.18 Openshift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.18 jenkins-2-plugins-4.18.1758260849-1.el9, jenkins-2.516.3.1758260563-3.el9
  • RHSA-2025:14911 Released 2025-08-28 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.10.6 for Spring Boot release.
    • Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat AMQ Broker 7AffectedNo fix planned: Will not fix
Red Hat JBoss Enterprise Application Platform 7AffectedNo fix yet
Red Hat Single Sign-On 7AffectedNo fix planned: Out of support scope
Red Hat build of Apache Camel 4 for Quarkus 3AffectedNo fix yet
Red Hat build of Apache Camel for Spring Boot 4AffectedNo fix yet
Red Hat build of Debezium 2AffectedNo fix planned: Will not fix
Red Hat build of Debezium 3AffectedNo fix planned: Will not fix
Red Hat build of OptaPlanner 8AffectedNo fix planned: Will not fix
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2025:16459
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2025:16460
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2025:16461
OpenShift Developer Tools and Services for OCP 4.15Fixed RHSA-2025:16462
OpenShift Developer Tools and Services for OCP 4.16Fixed RHSA-2025:16457
OpenShift Developer Tools and Services for OCP 4.17Fixed RHSA-2025:16456
OpenShift Developer Tools and Services for OCP 4.18Fixed RHSA-2025:16455
OpenShift Developer Tools and Services for OCP 4.19Fixed RHSA-2025:16454
Red Hat AMQ Broker 7.13.2Fixed RHSA-2025:17567
Red Hat Offline Knowledge Portal 1.1.2Fixed RHSA-2025:16989
Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9Fixed RHSA-2025:14911
Not affected: 12 products
  • Cryostat 4
  • Red Hat AMQ Clients
  • Red Hat Data Grid 8
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 8
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Process Automation 7
  • Red Hat build of Apache Camel - HawtIO 4
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Apicurio Registry 3
  • Red Hat build of Quarkus
  • streams for Apache Kafka 2

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-5115
  2. 2026-10-03 Alias added: GHSA-mmxm-8w33-wc4h
  3. 2026-10-09 Fix available: RHSA-2025:14911 · Red Hat
  4. 2026-11-05 Fix available: Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9 · Red Hat

References

Patch 1

Advisory 5

Other 8

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences