CVE-2024-22201CWE-400

Jetty connection leaking on idle timeout when TCP congested

High · published February 26, 2024

CVSS v3.1
7.5
EPSS
1%
Percentile
72.9
In the wild
Unconfirmed
What it is

Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.

The record
Technical detail
CVSS v3.1
7.5 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CVSS v4.0
Not supplied
EPSS
0.01433 · 72.9th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2024-02-26T16:13Z
EPSS history
Timeline
  • 26 FEB 16:13Z
    Jetty connection leaking on idle timeout when TCP congested
    cvelistv5