CVE-2021-28165CWE-400CWE-551

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame

High · published April 1, 2021

Patch now

High probability of exploitation

CVSS calls it high at 7.5. It sits in the 99.0th percentile for exploit probability.

CVSS v3.1
7.5
EPSS
54%
Percentile
99.0
In the wild
Unconfirmed
What it is

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.53861 · 99.0th percentile
Weaknesses
CWE-400 · Uncontrolled Resource Consumption; CWE-551 · Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
Published
2021-04-01T14:20Z
EPSS history
Timeline
  • 01 APR 14:20Z
    In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame
    cvelistv5