CVE-2022-2191

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-404CWE-664

Affected software

VendorProductVersions
The Eclipse FoundationEclipse Jetty>= 10.0.0, < unspecified; >= unspecified, <= 10.0.9; >= 11.0.0, < unspecified; >= unspecified, <= 11.0.9

References

Timeline

Published
Jul 7, 2022
Last modified
Jun 17, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-219107.8Microsoft Cluster Port Driver Elevation of Privilege VulnerabilityCVE-2022-219117.5.NET Framework Denial of Service VulnerabilityCVE-2022-219127.8DirectX Graphics Kernel Remote Code Execution VulnerabilityCVE-2022-219137.5Local Security Authority (Domain Policy) Remote Protocol Security Feature BypassCVE-2022-219147.8Windows Remote Access Connection Manager Elevation of Privilege VulnerabilityCVE-2022-219156.5Windows GDI+ Information Disclosure VulnerabilityCVE-2022-219167.8Windows Common Log File System Driver Elevation of Privilege VulnerabilityCVE-2022-219177.8HEVC Video Extensions Remote Code Execution VulnerabilityCVE-2022-219186.5DirectX Graphics Kernel File Denial of Service VulnerabilityCVE-2022-219197.0Windows User Profile Service Elevation of Privilege VulnerabilityCVE-2022-21928.8Forced Browsing vulnerability in HYPR Server version 6.10 to 6.15.1 allows remote attackers with a valid one-time recovery token to elevate CVE-2022-219208.8Windows Kerberos Elevation of Privilege Vulnerability
CVE-2022-2191: High severity, CVSS 7.5 | Vulnix