CVE-2024-22201: Jetty is a Java based web server and servlet engine

Description

Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector

Network

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

None

Integrity

None

Availability

High

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)1.4% · higher than 73% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

AI

Active IQ Unified Manager · Netapp

All versions, or not specified · source: NVD

BL

Bluexp · Netapp

All versions, or not specified · source: NVD

DL

Debian Linux · Debian

10.0 · source: NVD

JE

Jetty · Eclipse

9.3.0 before 9.4.54; 10.0.0 before 10.0.20; 11.0.0 before 11.0.20; 12.0.0 before 12.0.6 · source: NVD