CVE-2024-22201 — Uncontrolled Resource Consumption in Jetty

CWE-400 — Uncontrolled Resource ConsumptionCWE-770 — Allocation of Resources Without Limits or Throttling12 documents8 sources
Severity
7.5HIGHNVD
EPSS
0.6%
top 31.73%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Eclipse JettyJetty Jetty.projectDebian Linux
Timeline
PublishedFeb 26
Latest updateJul 15

Description

Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HExploitability: 3.9 | Impact: 3.6

Affected Packages2 packages

▶NVDeclipse/jetty9.3.0 — 9.4.54+3
▶CVEListV5jetty/jetty.project4 versions+3

Also affects: Debian Linux 10.0

🔴Vulnerability Details

4
OSV
CVE-2024-22201: Jetty is a Java based web server and servlet engine↗2024-02-26
▶
CVEList
Jetty connection leaking on idle timeout when TCP congested↗2024-02-26
▶
OSV
Connection leaking on idle timeout when TCP congested↗2024-02-26
▶
GHSA
Connection leaking on idle timeout when TCP congested↗2024-02-26
▶

📋Vendor Advisories

7
Oracle
Oracle Oracle Supply Chain Risk Matrix: Servlet Container (Eclipse Jetty) — CVE-2024-22201↗2025-07-15
▶
Oracle
Oracle Oracle Communications Applications Risk Matrix: Broadband Solution (Eclipse Jetty) — CVE-2024-22201↗2024-10-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Install (Eclipse Jetty) — CVE-2024-22201↗2024-07-15
▶
Oracle
Oracle Oracle Communications Risk Matrix: Install/Upgrade (Eclipse Jetty) — CVE-2024-22201↗2024-04-15
▶
Jenkins
Jenkins Security Advisory 2024-03-20↗2024-03-20
▶