CVE-2024-22201

Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.

Database specific

{
    "cna_assigner": "GitHub_M",
    "osv_generated_from": "https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/22xxx/CVE-2024-22201.json",
    "cwe_ids": [
        "CWE-400"
    ]
}

References

Affected packages

Git / github.com/eclipse/jetty.project

Affected ranges

Type

GIT

Repo

https://github.com/eclipse/jetty.project

Events

Introduced

390f3200cce7f90f1f3ebc78013c1afea2f93db8

Fixed

cef3fbd6d736a21e7d541a5db490381d95a2047d

Introduced

b9645a17373e4e9b7f30b6c0a07defcea2cb660b

Fixed

3a745c71c23682146f262b99f4ddc4c1bc41630c

Introduced

432f896d7a4555fcc81f38108757ea0aca8788e6

Fixed

922f8dc188f7011e60d0361de585fd4ac4d63064

Introduced

28100e8da711e44c0722ed10bd413ae862497539

Fixed

78ab6e6ba163f89cdd97f2ae0283fbb5e371cfaf

Introduced

Last affected

b9645a17373e4e9b7f30b6c0a07defcea2cb660b

Database specific

{
    "versions": [
        {
            "introduced": "9.3.0"
        },
        {
            "fixed": "9.4.54"
        },
        {
            "introduced": "10.0.0"
        },
        {
            "fixed": "10.0.20"
        },
        {
            "introduced": "11.0.0"
        },
        {
            "fixed": "11.0.20"
        },
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.0.6"
        },
        {
            "introduced": "0"
        },
        {
            "last_affected": "10.0"
        }
    ]
}

Affected versions

jetty-10.*

jetty-10.0.0

jetty-10.0.0.beta1

jetty-10.0.18

jetty-10.0.19

jetty-10.0.2

jetty-10.0.8

jetty-11.*

jetty-11.0.0-alpha0

jetty-11.0.0.beta1

jetty-11.0.0.beta2

jetty-11.0.18

jetty-11.0.19

jetty-11.0.2

jetty-11.0.8

jetty-11.0.9

jetty-12.*

jetty-12.0.0x

jetty-12.0.5

jetty-8.*

jetty-8.0.0.RC0

jetty-8.1.0.RC0

jetty-9.*

jetty-9.1.0.M0

jetty-9.1.0.RC0

jetty-9.1.0.RC1

jetty-9.1.0.RC2

jetty-9.1.0.v20131115

jetty-9.1.1.v20140108

jetty-9.1.2.v20140210

jetty-9.1.3.v20140225

jetty-9.1.4.v20140401

jetty-9.2.0.M0

jetty-9.2.0.M1

jetty-9.2.0.RC0

jetty-9.2.0.v20140523

jetty-9.2.0.v20140526

jetty-9.2.1.v20140609

jetty-9.4.10.v20180503

jetty-9.4.12.v20180830

jetty-9.4.13.v20181111

jetty-9.4.14.v20181114

jetty-9.4.15.v20190215

jetty-9.4.2.v20170220

jetty-9.4.26.v20200117

jetty-9.4.27.v20200227

jetty-9.4.28.v20200408

jetty-9.4.32.v20200930

jetty-9.4.36.v20210114

jetty-9.4.37.v20210219

jetty-9.4.39.v20210325

jetty-9.4.42.v20210604

jetty-9.4.6.v20170531

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22201.json"

Git / github.com/jetty/jetty.project

Affected ranges

Type

GIT

Repo

https://github.com/jetty/jetty.project

Events

Introduced

390f3200cce7f90f1f3ebc78013c1afea2f93db8

Last affected

27bde00a0b95a1d5bbee0eae7984f891d2d0f8c9

Database specific

{
    "versions": [
        {
            "introduced": "9.3.0"
        },
        {
            "last_affected": "9.4.53"
        }
    ]
}

Type

GIT

Repo

https://github.com/jetty/jetty.project

Events

Introduced

b9645a17373e4e9b7f30b6c0a07defcea2cb660b

Last affected

8492d1c78f122bb30cce20aecfa07e7283facd47

Database specific

{
    "versions": [
        {
            "introduced": "10.0.0"
        },
        {
            "last_affected": "10.0.19"
        }
    ]
}

Type

GIT

Repo

https://github.com/jetty/jetty.project

Events

Introduced

432f896d7a4555fcc81f38108757ea0aca8788e6

Last affected

f781e475c8fa9e9c8ce18b1eaa03110d510f905f

Database specific

{
    "versions": [
        {
            "introduced": "11.0.0"
        },
        {
            "last_affected": "11.0.19"
        }
    ]
}

Type

GIT

Repo

https://github.com/jetty/jetty.project

Events

Introduced

28100e8da711e44c0722ed10bd413ae862497539

Last affected

3aed62e4959bb8c01f5975fe81e078e3ff626126

Database specific

{
    "versions": [
        {
            "introduced": "12.0.0"
        },
        {
            "last_affected": "12.0.5"
        }
    ]
}

Affected versions

jetty-12.*

jetty-12.0.0x

jetty-12.0.5

Database specific

source

"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2024-22201.json"