Skip to content
OpenAdvisories
High · 7.5 CVE-2024-22201 EUVD-2024-0716GHSA-rggv-cv7r-mw98

Jetty connection leaking on idle timeout when TCP congested

Published Feb 26, 2024 · Updated Feb 13, 2025 · Assigned by GitHub_M

Vendor: jetty Product: jetty.project Package: jetty Package: jetty9 Package: org.eclipse.jetty.http2:http2-common Package: org.eclipse.jetty.http2:jetty-http2-common Package: org.eclipse.jetty.http3:http3-common Package: org.eclipse.jetty.http3:jetty-http3-common Ecosystem: Debian Ecosystem: Maven Ecosystem: Ubuntu

Description

Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.

Affected products

VendorProductAffectedFixed
jetty jetty.project >= 9.3.0, <= 9.4.53, >= 10.0.0, <= 10.0.19, >= 11.0.0, <= 11.0.19, >= 12.0.0, <= 12.0.5 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 jetty9 9.4.54-1 —
Debian 13 jetty9 9.4.54-1 —
Debian 12 jetty9 9.4.50-4+deb12u3 DSA-5664-1
Debian 11 jetty9 9.4.50-4+deb11u2 DSA-5664-1
Debian 10 jetty9 9.4.50-4+deb10u2 DLA-3780-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 16.04 LTS jetty No fix yet —
Ubuntu 14.04 LTS jetty No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Ocp Tools 4 jenkins 2.440.3.1716387933-3.el8 RHSA-2024:4597, RHSA-2024:3636, RHSA-2024:3635
Red Hat Ocp Tools 4 jenkins-2-plugins 4.12.1716445211-1.el8 RHSA-2024:4597, RHSA-2024:3636, RHSA-2024:3635

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP5 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
SLES 15 SP4 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
SLES 15 SP3 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
SLES 15 SP2 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
Show 7 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 SP4 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
SLES for SAP 15 SP3 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
SLES for SAP 15 SP2 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
SLE HPC 15 SP4 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
SLE HPC 15 SP3 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
SLE HPC 15 SP2 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1
SUSE Enterprise Storage 7.1 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Leap 15.5 jetty-minimal 9.4.54-150200.3.25.1 SUSE-SU-2024:0817-1

Affected packages

EcosystemPackageAffectedFixedRecord
Maven org.eclipse.jetty.http2:http2-common >= 9.3.0, < 9.4.54 9.4.54 GHSA-rggv-cv7r-mw98
Maven org.eclipse.jetty.http2:http2-common >= 10.0.0, < 10.0.20 10.0.20 GHSA-rggv-cv7r-mw98
Maven org.eclipse.jetty.http2:http2-common >= 11.0.0, < 11.0.20 11.0.20 GHSA-rggv-cv7r-mw98
Maven org.eclipse.jetty.http2:jetty-http2-common >= 12.0.0, < 12.0.6 12.0.6 GHSA-rggv-cv7r-mw98
Maven org.eclipse.jetty.http3:http3-common >= 10.0.8, < 10.0.20 10.0.20 GHSA-rggv-cv7r-mw98
Maven org.eclipse.jetty.http3:http3-common >= 11.0.8, < 11.0.20 11.0.20 GHSA-rggv-cv7r-mw98
Maven org.eclipse.jetty.http3:jetty-http3-common >= 12.0.0, < 12.0.6 12.0.6 GHSA-rggv-cv7r-mw98

Advisories 26

References