Description
In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.
For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal.
Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame.
The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.
The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.
Links:
* https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Jetty | Eclipse Jetty | >=9.3.0 – ≤ <=9.4.57, >=10.0.0 – ≤ <=10.0.25, >=11.0.0 – ≤ <=11.0.25, >=12.0.0 – ≤ <=12.0.21, >=12.1.0.alpha0 – ≤ <=12.1.0.alpha2 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jetty12 | 12.0.17-3.1 | — |
| Debian 14 | jetty9 | 9.4.57-1.1 | — |
| Debian 13 | jetty12 | 12.0.17-3.1~deb13u1 | DSA-6006-1 |
| Debian 13 | jetty9 | 9.4.57-1.1~deb13u1 | DSA-6005-1 |
| Debian 12 | jetty9 | 9.4.57-1.1~deb12u1 | DSA-6005-1 |
| Debian 11 | jetty9 | 9.4.57-0+deb11u3 | DLA-4299-1 |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jetty9 | No fix yet | — |
| Ubuntu 26.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 25.10 | jetty9 | No fix yet | — |
| Ubuntu 24.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 22.04 LTS | jetty9 | No fix yet | — |
Show 4 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 18.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 16.04 LTS | jetty +1 | No fix yet | — |
| Ubuntu 14.04 LTS | jetty | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Ocp Tools 4 | jenkins | 2.516.3.1758206866-3.el9 | RHSA-2025:16462, RHSA-2025:16461, RHSA-2025:16460 |
| Red Hat Ocp Tools 4 | jenkins-2-plugins | 4.12.1758299735-1.el8 | RHSA-2025:16462, RHSA-2025:16461, RHSA-2025:16460 |
SUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES 15 SP7 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SLES 15 SP6 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SLES 15 SP5 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SLES 15 SP4 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SLES 15 SP3 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
Show 7 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| SLES for SAP 15 SP5 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SLES for SAP 15 SP4 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SLES for SAP 15 SP3 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SLE HPC 15 SP5 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SLE HPC 15 SP4 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SLE HPC 15 SP3 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
| SUSE Enterprise Storage 7.1 | jetty-minimal | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-1 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | jetty-minimal | 9.4.58-1.1 | openSUSE-SU-2025:15482-1 |
| openSUSE Leap 15.6 | jetty-minimal +1 | 9.4.58-150200.3.34.1 | SUSE-SU-2025:02993-2, SUSE-SU-2025:02993-1 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | apache-activemq-artemis +1 | 2.42.0-r3 | — |
| Wolfi rolling | apache-nifi +2 | 2.5.0-r5 | — |
| Wolfi rolling | apache-nifi-registry +1 | 2.5.0-r2 | — |
| Wolfi rolling | jenkins-2 +6 | 2.524-r0 | — |
| Wolfi rolling | trino +58 | 476-r6 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty.http2:http2-common | >= 9.3.0, < 9.4.58 | 9.4.58 | GHSA-mmxm-8w33-wc4h |
| Maven | org.eclipse.jetty.http2:http2-common | >= 10.0.0, < 10.0.26 | 10.0.26 | GHSA-mmxm-8w33-wc4h |
| Maven | org.eclipse.jetty.http2:http2-common | >= 11.0.0, < 11.0.26 | 11.0.26 | GHSA-mmxm-8w33-wc4h |
| Maven | org.eclipse.jetty.http2:jetty-http2-common | >= 12.0.0, < 12.0.25 | 12.0.25 | GHSA-mmxm-8w33-wc4h |
| Maven | org.eclipse.jetty.http2:jetty-http2-common | >= 12.1.0.alpha0, < 12.1.0.beta3 | 12.1.0.beta3 | GHSA-mmxm-8w33-wc4h |
Advisories 33
- WID-SEC-2025-1830 http/2 Implementierungen: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Nov 3, 2026
- RHSA-2025:16462 Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 25, 2026
- RHSA-2025:16460 Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 25, 2026
- RHSA-2025:16461 Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 25, 2026
- RHSA-2025:16457 Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 25, 2026
- RHSA-2025:16459 Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 25, 2026
- RHSA-2025:16456 Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 25, 2026
- RHSA-2025:16454 Red Hat Security Advisory: Red Hat Product OCP Tools 4.19 OpenShift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 25, 2026
- RHSA-2025:16455 Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 Openshift Jenkins security update Red Hat Security Advisories (RHSA) · Sep 25, 2026
- WID-SEC-2026-0162 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Aug 24, 2026
- WID-SEC-2026-1204 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1197 Oracle REST Data Services: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- WID-SEC-2026-1194 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Apr 21, 2026
- openSUSE-SU-2025:15482-1 jetty-annotations-9.4.58-1.1 on GA media SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02993-2 Security update for jetty-minimal SUSE / openSUSE Security Updates · Mar 23, 2026
- SUSE-SU-2025:02993-1 Security update for jetty-minimal SUSE / openSUSE Security Updates · Mar 23, 2026
- DSA-6005-1 jetty9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DSA-6006-1 jetty12 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- DLA-4299-1 jetty9 - security update Debian Security (DSA / DLA) · Mar 9, 2026
- NCSC-2026-0027 Kwetsbaarheden verholpen in Oracle Fusion Middleware NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0025 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Jan 21, 2026
- NCSC-2026-0022 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Jan 21, 2026
- WID-SEC-2026-0153 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0175 Oracle Supply Chain: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2026-0163 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Jan 20, 2026
- WID-SEC-2025-2361 Oracle Communications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- WID-SEC-2025-2360 Oracle Communications Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Nov 17, 2025
- NCSC-2025-0333 Kwetsbaarheden verholpen in Oracle Financial Services NCSC-NL (Netherlands) · Oct 23, 2025
- NCSC-2025-0330 Kwetsbaarheden verholpen in Oracle Communications producten NCSC-NL (Netherlands) · Oct 23, 2025
- WID-SEC-2025-2356 Oracle Financial Services Applications: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 22, 2025
- NCSC-2025-0323 Kwetsbaarheden verholpen in SAP Producten NCSC-NL (Netherlands) · Oct 17, 2025
- WID-SEC-2025-2265 SAP Patchday Oktober 2025: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 13, 2025
- WID-SEC-2025-2086 Jenkins: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 23, 2025
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h issue-tracking
- https://github.com/jetty/jetty.project/pull/13449 patch
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.0 release-notes
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.25 release-notes
- https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.26 release-notes
- https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.26 release-notes
- https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.58.v20250814 release-notes