p PatchFirst

CVE-2021-28165

CVE-2021-28165

This page contains facts from public vulnerability sources. Check the original advisory before updating.

This page shows selected source facts. See the linked advisories for the complete description and affected versions.

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

CVSS 7.5 · High · EPSS 53.9% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • eclipse jetty

    Versions
    • ≥ 7.2.2, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 9.4.38: Affected (custom)
    • ≥ 10.0.0.alpha0, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 10.0.1: Affected (custom)
    • ≥ 11.0.0.alpha0, < unspecified: Affected (custom)
    • ≥ unspecified, ≤ 11.0.1: Affected (custom)

    No fix published

  • jetty9 Debian:12

    Affected ranges
    • ECOSYSTEM: < 9.4.39-1

    Update to 9.4.39-1

  • jetty9 Debian:13

    Affected ranges
    • ECOSYSTEM: < 9.4.39-1

    Update to 9.4.39-1

  • jetty9 Debian:14

    Affected ranges
    • ECOSYSTEM: < 9.4.39-1

    Update to 9.4.39-1

  • equinox-bundles Ubuntu:18.04:LTS

    Versions
    • 4.9-2~18.04
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • equinox-bundles Ubuntu:20.04:LTS

    Versions
    • 4.12-1
    • 4.13-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • equinox-bundles Ubuntu:22.04:LTS

    Versions
    • 4.18-1
    • 4.19-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →