CVE-2024-22201

HighCVSS 7.5/10Last modified Jun 17, 2026

Description

Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.

Metrics

CVSS 3.1 7.5/10CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Weakness enumeration

CWE-400 CWE-770

Affected software

Vendor	Product	Versions
jetty	jetty.project	>= 9.3.0, <= 9.4.53; >= 10.0.0, <= 10.0.19; >= 11.0.0, <= 11.0.19; >= 12.0.0, <= 12.0.5
jetty	jetty.project	>= 9.3.0, <= 9.4.53; >= 10.0.0, <= 10.0.19; >= 11.0.0, <= 11.0.19; >= 12.0.0, <= 12.0.5

References

http://www.openwall.com/lists/oss-security/2024/03/20/2Mailing List, Third Party Advisory
https://github.com/jetty/jetty.project/issues/11256Issue Tracking
https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00002.htmlMailing List
https://security.netapp.com/advisory/ntap-20240329-0001/Third Party Advisory
http://www.openwall.com/lists/oss-security/2024/03/20/2Mailing List, Third Party Advisory
https://github.com/jetty/jetty.project/issues/11256Issue Tracking
https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98Vendor Advisory
https://lists.debian.org/debian-lts-announce/2024/04/msg00002.htmlMailing List
https://security.netapp.com/advisory/ntap-20240329-0001/Third Party Advisory

Timeline

Published: Feb 26, 2024
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2024

CVE-2024-222026.5phpMyFAQ is an open source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. phpMyFAQ's user removal page allows a CVE-2024-222039.8Whoogle Search is a self-hosted metasearch engine. In versions prior to 0.8.4, the `element` method in `app/routes.py` does not validate the CVE-2024-222045.3Whoogle Search is a self-hosted metasearch engine. Versions 0.8.3 and prior have a limited file write vulnerability when the configuration o CVE-2024-222059.8Whoogle Search is a self-hosted metasearch engine. In versions 0.8.3 and prior, the `window` endpoint does not sanitize user-supplied input CVE-2024-222069.8Clerk helps developers build user management. Unauthorized access or privilege escalation due to a logic flaw in auth() in the App Router or CVE-2024-222075.3fastify-swagger-ui is a Fastify plugin for serving Swagger UI. Prior to 2.1.0, the default configuration of `@fastify/swagger-ui` without `CVE-2024-222086.5phpMyFAQ is an Open Source FAQ web application for PHP 8.1+ and MySQL, PostgreSQL and other databases. The 'sharing FAQ' functionality allow CVE-2024-222098.8Open edX Platform is a service-oriented platform for authoring and delivering online learning. A user with a JWT and more limited scopes cou CVE-2024-22219.8qdrant/qdrant is vulnerable to a path traversal and arbitrary file upload vulnerability via the `/collections/{COLLECTION}/snapshots/upload`CVE-2024-222119.8FreeRDP is a set of free and open source remote desktop protocol library and clients. In affected versions an integer overflow in `freerdp_b CVE-2024-222129.8Nextcloud Global Site Selector is a tool which allows you to run multiple small Nextcloud instances and redirect users to the right server. CVE-2024-222135.4Deck is a kanban style organization tool aimed at personal planning and project organization for teams integrated with Nextcloud. In affecte