CVE-2021-28165

CWE-400 — Uncontrolled Resource ConsumptionCWE-551CWE-755 — Improper Exception Handling14 documents9 sources
Severity
7.5HIGH
EPSS
12.0%
top 6.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
21
THE Eclipse Foundation Eclipse JettyEclipse JettyJenkins Jenkins+18 more
Timeline
PublishedApr 1
Latest updateOct 15

Description

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages23 packages

▶NVDeclipse/jetty7.2.2 — 9.4.39+2
▶Mavenorg.eclipse.jetty:jetty-server7.2.2 — 9.4.39+2
▶CVEListV5the_eclipse_foundation/eclipse_jetty7.2.2 — unspecified+5
▶Debianjetty9< 9.4.39-1+3
▶NVDjenkins/jenkins< 2.277.3+1

Patches

Patch: www.oracle.com ↗Patch: www.oracle.com ↗Patch: www.oracle.com ↗

🔴Vulnerability Details

4
OSV
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources↗2021-04-06
▶
GHSA
Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources↗2021-04-06
▶
CVEList
CVE-2021-28165: In Eclipse Jetty 7↗2021-04-01
▶
OSV
CVE-2021-28165: In Eclipse Jetty 7↗2021-04-01
▶

📋Vendor Advisories

9
Oracle
Oracle Oracle Siebel CRM Risk Matrix: Desktop Integration Siebel Agent (Apache ZooKeeper) — CVE-2021-28165↗2025-10-15
▶
Atlassian
CVE-2021-28165: DoS (Denial of Service) org.eclipse.jetty:jetty-io in Jira Software Data Center and Server↗2023-11-21
▶
Oracle
Oracle Oracle Fusion Middleware Risk Matrix: OUD Core (Eclipse Jetty) — CVE-2021-28165↗2023-10-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Platform (Eclipse Jetty) — CVE-2021-28165↗2022-10-15
▶
Oracle
Oracle Oracle REST Data Services Risk Matrix: General (Eclipse Jetty) — CVE-2021-28165↗2022-01-15
▶