CVE-2022-2191CWE-404CWE-664

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in…

High · published July 7, 2022

CVSS v3.1
7.5
EPSS
2%
Percentile
82.2
In the wild
Unconfirmed
What it is

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.02178 · 82.2th percentile
Weaknesses
CWE-404 · Improper Resource Shutdown or Release; CWE-664 · Improper Control of a Resource Through its Lifetime
Published
2022-07-07T20:45Z
EPSS history
Timeline
  • 07 JUL 20:45Z
    In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in…
    cvelistv5