Skip to content
OpenAdvisories
High DSA-5198-1 2 CVEs

jetty9 - security update

Published Aug 2, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 11 jetty9 9.4.39-3+deb11u1

Vulnerabilities 2

  • High 7.5
    CVE-2022-2048

    Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service

    In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario w…

    The Eclipse Foundation Eclipse Jetty jetty9 jenkins Debian Ubuntu Alpine Maven
  • Low 2.7
    CVE-2022-2047

    Jetty invalid URI parsing may produce invalid HttpURI.authority

    In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failu…

    The Eclipse Foundation Eclipse Jetty druid jetty9 Debian Ubuntu Wolfi Maven