Skip to content

Vendor

org.eclipse.jetty.http3 vulnerabilities

2 published CVES affecting org.eclipse.jetty.http3, from public sources (CVE.org, NVD, CISA KEV, FIRST EPSS, OSV).

Total
2
Critical
0
High
2
Medium
0
Low
0
Unscored
0
CISA KEV
0
Atom feed of org.eclipse.jetty.http3 alerts

Products

Latest org.eclipse.jetty.http3 CVEs

Newest publication first

  1. CVE-2024-22201 Jetty connection leaking on idle timeout when TCP congested

    Published
    HighCVSS 7.5 EPSS 1.4%

    Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing...

  2. CVE-2023-36478 HTTP/2 HPACK integer overflow and buffer allocation

    Published
    HighCVSS 7.5 EPSS 4.8%

    Eclipse Jetty provides a web server and servlet container. In versions 11.0.0 through 11.0.15, 10.0.0 through 10.0.15, and 9.0.0 through 9.4.52, an integer overflow in MetaDataBuilder.checkSize allows for HTTP/2 HPACK header values to exceed their size limit. MetaDataBuilder.java...

Sources: CVE.org, NVD, CISA KEV, FIRST EPSS, OSV and public exploit-reference metadata. Product matching comes from the published CVE records. A proof-of-concept means public code exists; it is not evidence of exploitation.