cbcvebase.
CVE-2021-28165
published 2021-04-01

CVE-2021-28165: In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

PriorityP356high7.5CVSS 3.1
AVNACLPRNUINSUCNINAH
EPSS
53.86%
98.9th percentile
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Affected

32 ranges· showing 25
VendorProductVersion rangeFixed in
atlassianjira_software
debianjetty9< jetty9 9.4.39-1 (bookworm)jetty9 9.4.39-1 (bookworm)
eclipsejetty>= 10.0.0 < 10.0.210.0.2
eclipsejetty>= 11.0.0 < 11.0.211.0.2
eclipsejetty>= 7.2.2 < 9.4.399.4.39
jenkinsjenkins< 2.277.32.277.3
jenkinsjenkins< 2.2862.286
jenkinsjenkins_core
jenkinsjenkins_lts
jenkinsjenkins_weekly
netappcloud_manager< 3.9.83.9.8
netappe-series_performance_analyzer< 3.03.0
netappe-series_santricity_os_controller>= 11.0.0 < 11.70.111.70.1
netappe-series_santricity_storage< 1.101.10
netappe-series_santricity_web_services< 5.15.1
netappontap_tools< 9.109.10
netappsantricity_web_services_proxy< 5.15.1
netappsnapcenter< 4.64.6
netappstorage_replication_adapter_for_clustered_data_ontap< 9.109.10
netappvasa_provider_for_clustered_data_ontap< 9.109.10
oracleautovue_for_agile_product_lifecycle_management
oraclecommunications_cloud_native_core_policy
oraclecommunications_element_manager
oraclecommunications_services_gatekeeper
oraclecommunications_session_report_manager8.0.0.0 – 8.2.4.0

Detection & IOCsextracted from sources · hover to see the quote

  • Trigger condition: server receives an invalid TLS frame larger than 17408 bytes, causing CPU to spike to 100% — monitor for abnormal CPU exhaustion on Jetty TLS endpoints
  • Affected protocols include SSL/TLS used with HTTP/1.1, HTTP/2, or WebSocket on Jetty — scope detection to all three protocol upgrade paths on Jetty listeners
  • ·Vulnerable Jetty version range: 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1 — ensure asset inventory covers all three major version branches
  • ·OCP metering stack components (hive/presto/hadoop) ship the vulnerable Jetty version and are marked wontfix as of OCP 4.6 deprecation — these remain unpatched and should be isolated or decommissioned
  • ·Red Hat OpenStack Platform's OpenDaylight will not receive a fix for this flaw (deprecated as of OpenStack Platform 14, only Critical/Important fixes applied)
  • ·Debian fix is available in version 9.4.39-1 across bookworm, bullseye, forky, sid, and trixie — use this as the minimum patched version benchmark for Debian-based deployments

CVSS provenance

nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
nvdv2.07.8HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C
osv7.5HIGH
vendor_debian7.5HIGH
vendor_oracle7.5HIGH
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.