Skip to content
OpenAdvisories

Package · Maven

org.eclipse.jetty.http2:jetty-http2-common

4 known vulnerabilities.

All Critical High Medium Low Exploited only Public exploit

4 results · Feed

  • High 7.7
    CVE-2025-5115

    MadeYouReset HTTP/2 vulnerability

    In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state,…

    Eclipse Jetty Eclipse Jetty trino trino-plugin-opensearch Debian Ubuntu Wolfi Maven
  • High 7.5
    CVE-2025-1948

    Eclipse Jetty HTTP clients can increase memory allocation

    In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a…

    Eclipse Foundation Jetty jetty9 jetty Debian Ubuntu Maven
  • High 7.5
    CVE-2024-22201

    Jetty connection leaking on idle timeout when TCP congested

    Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptor…

    jetty jetty.project jetty9 jetty Debian Ubuntu Maven
  • High 7.5
    CVE-2023-44487 Exploited Public exploit EPSS 100%

    HTTP/2 Stream Cancellation Attack

    The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

    nodejs golang go kubescape Debian Ubuntu Azure Linux Alpine Wolfi Maven Go SwiftURL
    KEV Oct 10, 2023