CVE-2022-2048

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-410CWE-664

Affected software

VendorProductVersions
The Eclipse FoundationEclipse Jetty>= 9.4.0, < unspecified; >= unspecified, <= 9.4.46; >= 10.0.0, < unspecified; >= unspecified, <= 10.0.9; >= 11.0.0, < unspecified; >= unspecified, <= 11.0.9

References

Timeline

Published
Jul 7, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-204807.8In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. CVE-2022-204815.5In multiple files, there is a possible way to preserve WiFi settings due to residual data after a reset. This could lead to local informatioCVE-2022-204825.5In createNotificationChannel of NotificationManager.java, there is a possible way to make the device unusable and require factory reset due CVE-2022-204837.5In several functions that parse avrc response in avrc_pars_ct.cc and related files, there are possible out of bounds reads due to integer ovCVE-2022-204847.8In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. CVE-2022-204857.8In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. CVE-2022-204867.8In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. CVE-2022-204877.8In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. CVE-2022-204887.8In NotificationChannel of NotificationChannel.java, there is a possible failure to persist permissions settings due to resource exhaustion. CVE-2022-204897.8In many functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This couCVE-2022-20497.5In affected versions of Octopus Deploy it is possible to perform a Regex Denial of Service via the package upload function.CVE-2022-204907.8In multiple functions of AutomaticZenRule.java, there is a possible failure to persist permissions settings due to resource exhaustion. This
CVE-2022-2048: High severity, CVSS 7.5 | Vulnix