{"id":"CVE-2025-5115","aliases":["CLSA-2026-1770163741","CLSA-2026-1773879458","CLSA-2026-1775781157","CLSA-2026-1779065189","CLSA-2026-1779065207","CLSA-2026-1779151632","CLSA-2026-1779842949","CLSA-2026-1779842950","CLSA-2026-1786553094","CLSA-2026-1788878815","CLSA-2026-1792753531","CLSA-2026-1792756836","CLSA-2026-1793132217","CLSA-2026-1794182179","CLSA-2026-1794251641","DEBIAN-CVE-2025-5115","DLA-4299-1","DSA-6005-1","DSA-6006-1","EUVD-2025-25397","GHSA-58qw-p7qm-5rvh","GHSA-mmxm-8w33-wc4h","RHSA-2025:16454","RHSA-2025:16455","RHSA-2025:16456","RHSA-2025:16457","RHSA-2025:16459","RHSA-2025:16460","RHSA-2025:16461","RHSA-2025:16462","ROOT-APP-MAVEN-CVE-2025-5115","SUSE-SU-2025:02993-1","SUSE-SU-2025:02993-2","UBUNTU-CVE-2025-5115","openSUSE-SU-2025:15482-1"],"status":"published","title":"MadeYouReset HTTP/2 vulnerability","description":"In Eclipse Jetty, versions \u003c=9.4.57, \u003c=10.0.25, \u003c=11.0.25, \u003c=12.0.21, \u003c=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.\n\n\nFor example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal.\nPer specification  https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame.\nThe client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.\n\n\nThe attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.\n\n\n\nLinks:\n\n\n\n  *   https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h","severity":{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.03566,"percentile":0.89435,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-611","CWE-770"],"published":"2023-07-10T21:52:39Z","modified":"2026-11-10T01:15:05Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","fixed_in":["11.0.16","10.0.16","12.0.0","9.4.52.v20230823"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jetty.http2:http2-common","fixed_in":["9.4.58","10.0.26","11.0.26"],"sources":["ghsa","osv"]},{"ecosystem":"Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","fixed_in":["12.0.25","12.1.0.beta3"],"sources":["ghsa","osv"]},{"ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","fixed_in":["9.4.53.v20231009-tuxcare.7"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jetty12","fixed_in":["12.0.17-3.1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty12","fixed_in":["12.0.17-3.1"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"jetty9","fixed_in":["9.4.57-1.1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"jetty9","fixed_in":["9.4.57-1.1~deb13u1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty9","fixed_in":["9.4.57-1.1"],"sources":["osv"]},{"ecosystem":"Debian:11","package":"jetty9","fixed_in":["9.4.57-0+deb11u3"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.19::el9","package":"jenkins","fixed_in":["0:2.516.3.1758206866-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.19::el9","package":"jenkins-2-plugins","fixed_in":["0:4.19.1758207171-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.18::el9","package":"jenkins","fixed_in":["0:2.516.3.1758260563-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.18::el9","package":"jenkins-2-plugins","fixed_in":["0:4.18.1758260849-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.17::el9","package":"jenkins","fixed_in":["0:2.516.3.1758259817-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.17::el9","package":"jenkins-2-plugins","fixed_in":["0:4.17.1758260106-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.16::el9","package":"jenkins","fixed_in":["0:2.516.3.1758336945-3.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.16::el9","package":"jenkins-2-plugins","fixed_in":["0:4.16.1758337173-1.el9"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","fixed_in":["0:2.516.3.1758299374-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","fixed_in":["0:4.12.1758299735-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","fixed_in":["0:2.516.3.1758298953-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","fixed_in":["0:4.13.1758299004-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins","fixed_in":["0:2.516.3.1758302106-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins-2-plugins","fixed_in":["0:4.14.1758302383-1.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins","fixed_in":["0:2.516.3.1758302665-3.el8"],"sources":["osv"]},{"ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins-2-plugins","fixed_in":["0:4.15.1758303157-1.el8"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","fixed_in":["12.0.13-aikido.7","12.0.3-aikido.7","12.0.13-aikido.8","12.0.13-aikido.9","12.0.16-aikido.4","12.0.3-aikido.8","12.0.13-aikido.10","12.0.16-aikido.5","12.0.3-aikido.9"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty.http2:jetty-http2-common","fixed_in":["12.0.3-root.io.3","12.0.13-root.io.6","12.0.16-root.io.2","12.0.3-root.io.4","12.0.3-root.io.5","12.0.3-root.io.6","12.0.13-root.io.7","12.0.3-root.io.7","12.0.16-root.io.3","12.0.13-root.io.8","12.0.13-root.io.9","12.0.16-root.io.4","12.0.3-root.io.8","12.0.13-root.io.10","12.0.16-root.io.5","12.0.3-root.io.9"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"jetty-minimal","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"jetty-websocket","fixed_in":["9.4.58-150200.3.34.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"jetty-minimal","fixed_in":["9.4.58-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-alpha0"},{"last_affected":"11.0.15"},{"fixed":"11.0.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-alpha0"},{"last_affected":"10.0.15"},{"fixed":"10.0.16"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0.alpha0"},{"last_affected":"12.0.0.beta4"},{"fixed":"12.0.0"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"last_affected":"9.4.51"},{"fixed":"9.4.52.v20230823"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3.0"},{"last_affected":"9.4.57"},{"fixed":"9.4.58"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"last_affected":"10.0.25"},{"fixed":"10.0.26"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"last_affected":"11.0.25"},{"fixed":"11.0.26"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.24"},{"fixed":"12.0.25"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0.alpha0"},{"last_affected":"12.1.0.beta2"},{"fixed":"12.1.0.beta3"}]}]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.59"},{"fixed":"9.4.59.tuxcare00001"}]}],"versions":["9.4.59"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.59"},{"fixed":"9.4.59.tuxcare00001"}]}],"versions":["9.4.59"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.60"},{"fixed":"9.4.60.tuxcare0001"}]}],"versions":["9.4.60"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.60"},{"fixed":"9.4.60.tuxcare0001"}]}],"versions":["9.4.60"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.61"},{"fixed":"9.4.61.tuxcare0001"}]}],"versions":["9.4.61"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.61"},{"fixed":"9.4.61.tuxcare0001"}]}],"versions":["9.4.61"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:javax-websocket-client-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:javax-websocket-server-impl","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-api","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.websocket:websocket-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-annotations","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-bom","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-continuation","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-io","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jmx","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jndi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-plus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-servlet","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-servlets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-util","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-util-ajax","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.41.v20210516"},{"fixed":"9.4.41.v20210516-tuxcare.1"}]}],"versions":["9.4.41.v20210516"],"bundled":8},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.62"},{"fixed":"9.4.62.tuxcare0001"}]}],"versions":["9.4.62"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.62"},{"fixed":"9.4.62.tuxcare0001"}]}],"versions":["9.4.62"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.24.v20191120"},{"fixed":"9.4.24.v20191120-tuxcare.2"}]}],"versions":["9.4.24.v20191120","9.4.24.v20191120-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.24.v20191120"},{"fixed":"9.4.24.v20191120-tuxcare.2"}]}],"versions":["9.4.24.v20191120","9.4.24.v20191120-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.57.v20241219"},{"fixed":"9.4.57.v20241219-tuxcare.1"}]}],"versions":["9.4.57.v20241219"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.57.v20241219"},{"fixed":"9.4.57.v20241219-tuxcare.1"}]}],"versions":["9.4.57.v20241219"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-servlets","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.48.v20220622"},{"fixed":"9.4.48.v20220622-tuxcare.2"}]}],"versions":["9.4.48.v20220622","9.4.48.v20220622-tuxcare.1"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.53.v20231009"},{"fixed":"9.4.53.v20231009-tuxcare.7"}]}],"versions":["9.4.53.v20231009","9.4.53.v20231009-tuxcare.1","9.4.53.v20231009-tuxcare.2","9.4.53.v20231009-tuxcare.3","9.4.53.v20231009-tuxcare.4","9.4.53.v20231009-tuxcare.5","9.4.53.v20231009-tuxcare.6"]},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.5"}]}],"versions":["9.4.50.v20221201","9.4.50.v20221201-tuxcare.1","9.4.50.v20221201-tuxcare.2","9.4.50.v20221201-tuxcare.3","9.4.50.v20221201-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.50.v20221201"},{"fixed":"9.4.50.v20221201-tuxcare.5"}]}],"versions":["9.4.50.v20221201","9.4.50.v20221201-tuxcare.1","9.4.50.v20221201-tuxcare.2","9.4.50.v20221201-tuxcare.3","9.4.50.v20221201-tuxcare.4"],"bundled":2},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.1"}]}],"versions":["11.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.1"}]}],"versions":["11.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.18"},{"fixed":"11.0.18-tuxcare.1"}]}],"versions":["11.0.18"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.4"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.4"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.19"},{"fixed":"11.0.19-tuxcare.4"}]}],"versions":["11.0.19","11.0.19-tuxcare.1","11.0.19-tuxcare.2","11.0.19-tuxcare.3"],"bundled":4},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee10:jetty-ee10-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee8:jetty-ee8-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.ee9:jetty-ee9-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-http","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-security","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.22"},{"fixed":"12.0.22-tuxcare.1"}]}],"versions":["12.0.22"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.26"},{"fixed":"10.0.26-tuxcare.4"}]}],"versions":["10.0.26","10.0.26-tuxcare.1","10.0.26-tuxcare.2","10.0.26-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.26"},{"fixed":"10.0.26-tuxcare.4"}]}],"versions":["10.0.26","10.0.26-tuxcare.1","10.0.26-tuxcare.2","10.0.26-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-webapp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.26"},{"fixed":"10.0.26-tuxcare.4"}]}],"versions":["10.0.26","10.0.26-tuxcare.1","10.0.26-tuxcare.2","10.0.26-tuxcare.3"],"bundled":3},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty.http2:http2-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-jaspi","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-openid","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"TuxCare:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.4.51.v20230217"},{"fixed":"9.4.51.v20230217-tuxcare.2"}]}],"versions":["9.4.51.v20230217","9.4.51.v20230217-tuxcare.1"],"bundled":5},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-3.1~deb13u1"}]}],"versions":["12.0.17-3"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-3.1"}]}],"versions":["12.0.17-3","12.0.17-3.1~deb13u1"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-1.1~deb12u1"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-1.1~deb13u1"}]}],"versions":["9.4.57-1","9.4.57-1.1~deb12u1"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-1.1"}]}],"versions":["9.4.57-1","9.4.57-1.1~deb12u1","9.4.57-1.1~deb13u1"]},{"source":"osv","ecosystem":"Debian:11","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-0+deb11u3"}]}],"versions":["9.4.39-3","9.4.39-3+deb11u1","9.4.39-3+deb11u2","9.4.44-1","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1","9.4.46-1","9.4.48-1","9.4.49-1","9.4.49-1.1","9.4.50-1","9.4.50-1~bpo11+1","9.4.50-2","9.4.50-3","9.4.50-4","9.4.50-4+deb11u1","9.4.50-4+deb11u2","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb11u1","9.4.57-0+deb11u2"]},{"source":"osv","ecosystem":"Debian:12","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-1.1~deb12u1"}]}],"versions":["9.4.50-4","9.4.50-4+deb12u1","9.4.50-4+deb12u2","9.4.50-4+deb12u3","9.4.51-1","9.4.51-2","9.4.52-1","9.4.53-1","9.4.54-1","9.4.55-1","9.4.56-1","9.4.57-0+deb12u1","9.4.57-1"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.57-1.1~deb13u1"}]}],"versions":["9.4.57-1","9.4.57-1.1~deb12u1"]},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-3.1~deb13u1"}]}],"versions":["12.0.17-3"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0-alpha0"},{"fixed":"10.0.16"}]}],"versions":["10.0.0","10.0.0-alpha0","10.0.0.alpha1","10.0.0.alpha2","10.0.0.beta0","10.0.0.beta1","10.0.0.beta2","10.0.0.beta3","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.2","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0-alpha0"},{"fixed":"11.0.16"}]}],"versions":["11.0.0","11.0.0-alpha0","11.0.0.beta1","11.0.0.beta2","11.0.0.beta3","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.2","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0.alpha0"},{"fixed":"12.0.0"}]}],"versions":["12.0.0.alpha0","12.0.0.alpha1","12.0.0.alpha2","12.0.0.alpha3","12.0.0.beta0","12.0.0.beta1","12.0.0.beta2","12.0.0.beta3","12.0.0.beta4"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-xml","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.52.v20230823"}]}],"versions":["7.0.0.M0","7.0.0.M1","7.0.0.M2","7.0.0.M3","7.0.0.M4","7.0.0.RC0","7.0.0.RC1","7.0.0.RC2","7.0.0.RC3","7.0.0.RC4","7.0.0.RC5","7.0.0.RC6","7.0.0.v20091005","7.0.1.v20091125","7.0.2.RC0","7.0.2.v20100331","7.1.0.RC0","7.1.0.RC1","7.1.0.v20100505","7.1.1.v20100517","7.1.2.v20100523","7.1.3.v20100526","7.1.4.v20100610","7.1.5.v20100705","7.1.6.v20100715","7.2.0.RC0","7.2.0.v20101020","7.2.1.v20101111","7.2.2.v20101205","7.3.0.v20110203","7.3.1.v20110307","7.4.0.RC0","7.4.0.v20110414","7.4.1.v20110513","7.4.2.v20110526","7.4.3.v20110701","7.4.4.v20110707","7.4.5.v20110725","7.5.0.RC0","7.5.0.RC1","7.5.0.RC2","7.5.0.v20110901","7.5.1.v20110908","7.5.2.v20111006","7.5.3.v20111011","7.5.4.v20111024","7.6.0.RC0","7.6.0.RC1","7.6.0.RC2","7.6.0.RC3","7.6.0.RC4","7.6.0.RC5","7.6.0.v20120127","7.6.1.v20120215","7.6.10.v20130312","7.6.11.v20130520","7.6.12.v20130726","7.6.13.v20130916","7.6.14.v20131031","7.6.15.v20140411","7.6.16.v20140903","7.6.17.v20150415","7.6.18.v20150929","7.6.19.v20160209","7.6.2.v20120308","7.6.20.v20160902","7.6.21.v20160908","7.6.3.v20120416","7.6.4.v20120524","7.6.5.v20120716","7.6.6.v20120903","7.6.7.v20120910","7.6.8.v20121106","7.6.9.v20130131","8.0.0.M0","8.0.0.M1","8.0.0.M2","8.0.0.M3","8.0.0.RC0","8.0.0.v20110901","8.0.1.v20110908","8.0.2.v20111006","8.0.3.v20111011","8.0.4.v20111024","8.1.0.RC0","8.1.0.RC1","8.1.0.RC2","8.1.0.RC4","8.1.0.RC5","8.1.0.v20120127","8.1.1.v20120215","8.1.10.v20130312","8.1.11.v20130520","8.1.12.v20130726","8.1.13.v20130916","8.1.14.v20131031","8.1.15.v20140411","8.1.16.v20140903","8.1.17.v20150415","8.1.18.v20150929","8.1.19.v20160209","8.1.2.v20120308","8.1.20.v20160902","8.1.21.v20160908","8.1.22.v20160922","8.1.3.v20120416","8.1.4.v20120524","8.1.5.v20120716","8.1.6.v20120903","8.1.7.v20120910","8.1.8.v20121106","8.1.9.v20130131","8.2.0.v20160908","9.0.0.M0","9.0.0.M1","9.0.0.M2","9.0.0.M3","9.0.0.M4","9.0.0.M5","9.0.0.RC0","9.0.0.RC1","9.0.0.RC2","9.0.0.v20130308","9.0.1.v20130408","9.0.2.v20130417","9.0.3.v20130506","9.0.4.v20130625","9.0.5.v20130815","9.0.6.v20130930","9.0.7.v20131107","9.1.0.M0","9.1.0.RC0","9.1.0.RC1","9.1.0.RC2","9.1.0.v20131115","9.1.1.v20140108","9.1.2.v20140210","9.1.3.v20140225","9.1.4.v20140401","9.1.5.v20140505","9.1.6.v20160112","9.2.0.M0","9.2.0.M1","9.2.0.RC0","9.2.0.v20140526","9.2.1.v20140609","9.2.10.v20150310","9.2.11.M0","9.2.11.v20150529","9.2.12.M0","9.2.12.v20150709","9.2.13.v20150730","9.2.14.v20151106","9.2.15.v20160210","9.2.16.v20160414","9.2.17.v20160517","9.2.18.v20160721","9.2.19.v20160908","9.2.2.v20140723","9.2.20.v20161216","9.2.21.v20170120","9.2.22.v20170606","9.2.23.v20171218","9.2.24.v20180105","9.2.25.v20180606","9.2.26.v20180806","9.2.27.v20190403","9.2.28.v20190418","9.2.29.v20191105","9.2.3.v20140905","9.2.30.v20200428","9.2.4.v20141103","9.2.5.v20141112","9.2.6.v20141205","9.2.7.v20150116","9.2.8.v20150217","9.2.9.v20150224","9.3.0.M0","9.3.0.M1","9.3.0.M2","9.3.0.RC0","9.3.0.RC1","9.3.0.v20150612","9.3.1.v20150714","9.3.10.M0","9.3.10.v20160621","9.3.11.M0","9.3.11.v20160721","9.3.12.v20160915","9.3.13.M0","9.3.13.v20161014","9.3.14.v20161028","9.3.15.v20161220","9.3.16.v20170120","9.3.17.RC0","9.3.17.v20170317","9.3.18.v20170406","9.3.19.v20170502","9.3.2.v20150730","9.3.20.v20170531","9.3.21.M0","9.3.21.RC0","9.3.21.v20170918","9.3.22.v20171030","9.3.23.v20180228","9.3.24.v20180605","9.3.25.v20180904","9.3.26.v20190403","9.3.27.v20190418","9.3.28.v20191105","9.3.29.v20201019","9.3.3.v20150827","9.3.30.v20211001","9.3.4.RC0","9.3.4.RC1","9.3.4.v20151007","9.3.5.v20151012","9.3.6.v20151106","9.3.7.RC0","9.3.7.RC1","9.3.7.v20160115","9.3.8.RC0","9.3.8.v20160314","9.3.9.M0","9.3.9.M1","9.3.9.v20160517","9.4.0.M0","9.4.0.M1","9.4.0.RC0","9.4.0.RC1","9.4.0.RC2","9.4.0.RC3","9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"9.3.0"},{"fixed":"9.4.58"}]}],"versions":["9.3.0.v20150612","9.3.1.v20150714","9.3.10.M0","9.3.10.v20160621","9.3.11.M0","9.3.11.v20160721","9.3.12.v20160915","9.3.13.M0","9.3.13.v20161014","9.3.14.v20161028","9.3.15.v20161220","9.3.16.v20170120","9.3.17.RC0","9.3.17.v20170317","9.3.18.v20170406","9.3.19.v20170502","9.3.2.v20150730","9.3.20.v20170531","9.3.21.M0","9.3.21.RC0","9.3.21.v20170918","9.3.22.v20171030","9.3.23.v20180228","9.3.24.v20180605","9.3.25.v20180904","9.3.26.v20190403","9.3.27.v20190418","9.3.28.v20191105","9.3.29.v20201019","9.3.3.v20150827","9.3.30.v20211001","9.3.4.RC0","9.3.4.RC1","9.3.4.v20151007","9.3.5.v20151012","9.3.6.v20151106","9.3.7.RC0","9.3.7.RC1","9.3.7.v20160115","9.3.8.RC0","9.3.8.v20160314","9.3.9.M0","9.3.9.M1","9.3.9.v20160517","9.4.0.M0","9.4.0.M1","9.4.0.RC0","9.4.0.RC1","9.4.0.RC2","9.4.0.RC3","9.4.0.v20161208","9.4.0.v20180619","9.4.1.v20170120","9.4.1.v20180619","9.4.10.RC0","9.4.10.RC1","9.4.10.v20180503","9.4.11.v20180605","9.4.12.RC0","9.4.12.RC1","9.4.12.RC2","9.4.12.v20180830","9.4.13.v20181111","9.4.14.v20181114","9.4.15.v20190215","9.4.16.v20190411","9.4.17.v20190418","9.4.18.v20190429","9.4.19.v20190610","9.4.2.v20170220","9.4.2.v20180619","9.4.20.v20190813","9.4.21.v20190926","9.4.22.v20191022","9.4.23.v20191118","9.4.24.v20191120","9.4.25.v20191220","9.4.26.v20200117","9.4.27.v20200227","9.4.28.v20200408","9.4.29.v20200521","9.4.3.v20170317","9.4.3.v20180619","9.4.30.v20200611","9.4.31.v20200723","9.4.32.v20200930","9.4.33.v20201020","9.4.34.v20201102","9.4.35.v20201120","9.4.36.v20210114","9.4.37.v20210219","9.4.38.v20210224","9.4.39.v20210325","9.4.4.v20170414","9.4.4.v20180619","9.4.40.v20210413","9.4.41.v20210516","9.4.42.v20210604","9.4.43.v20210629","9.4.44.v20210927","9.4.45.v20220203","9.4.46.v20220331","9.4.47.v20220610","9.4.48.v20220622","9.4.49.v20220914","9.4.5.v20170502","9.4.5.v20180619","9.4.50.v20221201","9.4.51.v20230217","9.4.52.v20230823","9.4.53.v20231009","9.4.54.v20240208","9.4.55.v20240627","9.4.56.v20240826","9.4.57.v20241219","9.4.6.v20170531","9.4.6.v20180619","9.4.7.RC0","9.4.7.v20170914","9.4.7.v20180619","9.4.8.v20171121","9.4.8.v20180619","9.4.9.v20180320"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"10.0.0"},{"fixed":"10.0.26"}]}],"versions":["10.0.0","10.0.1","10.0.10","10.0.11","10.0.12","10.0.13","10.0.14","10.0.15","10.0.16","10.0.17","10.0.18","10.0.19","10.0.2","10.0.20","10.0.21","10.0.22","10.0.23","10.0.24","10.0.25","10.0.3","10.0.4","10.0.5","10.0.6","10.0.7","10.0.8","10.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.http2:http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"11.0.0"},{"fixed":"11.0.26"}]}],"versions":["11.0.0","11.0.1","11.0.10","11.0.11","11.0.12","11.0.13","11.0.14","11.0.15","11.0.16","11.0.17","11.0.18","11.0.19","11.0.2","11.0.20","11.0.21","11.0.22","11.0.23","11.0.24","11.0.25","11.0.3","11.0.4","11.0.5","11.0.6","11.0.7","11.0.8","11.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.25"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.3","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0.alpha0"},{"fixed":"12.1.0.beta3"}]}],"versions":["12.1.0.alpha0","12.1.0.alpha1","12.1.0.alpha2","12.1.0.beta0","12.1.0.beta1","12.1.0.beta2"]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.19::el9","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.516.3.1758206866-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.19::el9","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.19.1758207171-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.18::el9","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.516.3.1758260563-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.18::el9","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.1758260849-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.17::el9","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.516.3.1758259817-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.17::el9","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.1758260106-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.16::el9","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.516.3.1758336945-3.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.16::el9","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.1758337173-1.el9"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.516.3.1758299374-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1758299735-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.516.3.1758298953-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1758299004-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.516.3.1758302106-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.1758302383-1.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.516.3.1758302665-3.el8"}]}]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.15.1758303157-1.el8"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.13-aikido.7"},{"fixed":"12.0.3-aikido.7"},{"fixed":"12.0.13-aikido.8"},{"fixed":"12.0.13-aikido.9"},{"fixed":"12.0.16-aikido.4"},{"fixed":"12.0.3-aikido.8"},{"fixed":"12.0.13-aikido.10"},{"fixed":"12.0.16-aikido.5"},{"fixed":"12.0.3-aikido.9"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-root.io.3"},{"fixed":"12.0.13-root.io.6"},{"fixed":"12.0.16-root.io.2"},{"fixed":"12.0.3-root.io.4"},{"fixed":"12.0.3-root.io.5"},{"fixed":"12.0.3-root.io.6"},{"fixed":"12.0.13-root.io.7"},{"fixed":"12.0.3-root.io.7"},{"fixed":"12.0.16-root.io.3"},{"fixed":"12.0.13-root.io.8"},{"fixed":"12.0.13-root.io.9"},{"fixed":"12.0.16-root.io.4"},{"fixed":"12.0.3-root.io.8"},{"fixed":"12.0.13-root.io.10"},{"fixed":"12.0.16-root.io.5"},{"fixed":"12.0.3-root.io.9"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP6","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Development Tools 15 SP7","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP6","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Package Hub 15 SP7","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-ESPOS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP5-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP5-LTSS","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP5","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"jetty-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"jetty-websocket","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-150200.3.34.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-1ubuntu1","6.1.26-1ubuntu1.1","6.1.26-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-5","6.1.26-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.56-1","9.4.57-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"jetty-minimal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"9.4.58-1.1"}]}]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"eclipse jetty","product":"eclipse jetty"}],"references":[{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h","tags":["issue-tracking","Third Party Advisory","report","web","article"]},{"url":"https://github.com/jetty/jetty.project/pull/13449","tags":["patch","Issue Tracking","fix","web","report"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.0","tags":["release-notes","Release Notes","advisory","web","report"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.25","tags":["release-notes","Release Notes","advisory","web","report"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.26","tags":["release-notes","Release Notes","advisory","web","report"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.26","tags":["release-notes","Release Notes","advisory","web","report"]},{"url":"https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.58.v20250814","tags":["release-notes","Release Notes","advisory","web","report"]},{"url":"https://lists.debian.org/debian-lts-announce/2025/09/msg00014.html","tags":["Issue Tracking","Mailing List","web"]},{"url":"https://www.kb.cert.org/vuls/id/767506","tags":["Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/09/17/1","tags":["Third Party Advisory","web"]},{"url":"http://www.openwall.com/lists/oss-security/2025/08/20/4","tags":["Third Party Advisory","web"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-58qw-p7qm-5rvh","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/pull/10067","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/releases/tag/jetty-10.0.16","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/releases/tag/jetty-11.0.16","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/releases/tag/jetty-12.0.0","tags":["web"]},{"url":"https://github.com/eclipse/jetty.project/releases/tag/jetty-9.4.52.v20230823","tags":["web"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-58qw-p7qm-5rvh","tags":["web"]},{"url":"https://github.com/advisories/GHSA-58qw-p7qm-5rvh"},{"url":"https://github.com/jetty/jetty.project/commit/f9ee3904788b08203ed62c95a560d951da37bdb1","tags":["web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-5115","tags":["advisory"]},{"url":"https://github.com/advisories/GHSA-mmxm-8w33-wc4h"},{"url":"https://repo.maven.apache.org/maven2","tags":["web"]},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/5xxx/CVE-2025-5115.json","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-5115","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16454","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2373310","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16454.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-5115","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-5115","tags":["advisory","report"]},{"url":"https://kb.cert.org/vuls/id/767506","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16455","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16455.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16456","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16456.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16457","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16457.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16459","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16459.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16460","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16460.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16461","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16461.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:16462","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_16462.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502993-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1244252","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2025-5115","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2025/suse-su-202502993-2/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-5115","tags":["report"]},{"url":"","tags":["advisory"]}],"sources":{"cve":[{"id":"CVE-2025-5115","title":"MadeYouReset HTTP/2 vulnerability","description":"In Eclipse Jetty, versions \u003c=9.4.57, \u003c=10.0.25, \u003c=11.0.25, \u003c=12.0.21, \u003c=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.\n\n\nFor example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal.\nPer specification  https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame.\nThe client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.\n\n\nThe attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.\n\n\n\nLinks:\n\n\n\n  *   https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h","status":"published","published":"2025-08-20T19:07:11.546Z","modified":"2025-11-04T21:11:37.182Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:29.607786Z"}],"euvd":[{"id":"EUVD-2025-25397","description":"In Eclipse Jetty, versions \u003c=9.4.57, \u003c=10.0.25, \u003c=11.0.25, \u003c=12.0.21, \u003c=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.\n\n\nFor example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal.\nPer specification  https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame.\nThe client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.\n\n\nThe attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.\n\n\n\nLinks:\n\n\n\n  *   https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h","status":"published","published":"2025-08-20T19:07:11Z","modified":"2025-11-04T21:11:37Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","level":"high"}],"updated_at":"2026-11-02T19:49:21.143143Z"}],"ghsa":[{"id":"GHSA-58qw-p7qm-5rvh","title":"Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations","description":"### From the reporter\n\n\u003e `XmlParser` is vulnerable to XML external entity (XXE) vulnerability.\n\u003e  XmlParser is being used when parsing Jetty’s xml configuration files. An attacker might exploit\n\u003e this vulnerability in order to achieve SSRF or cause a denial of service.\n\u003e One possible scenario is importing a (remote) malicious WAR into a Jetty’s server, while the\n\u003e WAR includes a malicious web.xml.\n\n### Impact\nThere are no circumstances in a normally deployed Jetty server where potentially hostile XML is given to the XmlParser class without the attacker already having arbitrary access to the server. I.e. in order to exploit `XmlParser` the attacker would already have the ability to deploy and execute hostile code.  Specifically, Jetty has no protection against malicious web application and potentially hostile web applications should only be run on an isolated virtualisation.  \n\nThus this is not considered a vulnerability of the Jetty server itself, as any such usage of the jetty XmlParser is equally vulnerable as a direct usage of the JVM supplied SAX parser.  No CVE will be allocated to this advisory.\n\nHowever, any direct usage of the `XmlParser` class by an application may be vulnerable.  The impact would greatly depend on how the application uses `XmlParser`, but it could be a denial of service due to large entity expansion, or possibly the revealing local files if the XML results are accessible remotely.\n\n### Patches\nAbility to configure the SAXParserFactory to fit the needs of your particular XML parser implementation have been merged as part of PR #10067\n\n### Workarounds\nDon't use Jetty's `XmlParser` to parse data from users.","status":"published","published":"2023-07-10T21:52:39Z","modified":"2026-02-10T20:06:18Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T14:39:24.742346Z"},{"id":"GHSA-mmxm-8w33-wc4h","title":"Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability","description":"## Technical Details \nBelow is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.”\n\n### MadeYouReset Vulnerability Summary\nThe MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service.\n\n### Mechanism\nThe vulnerability uses malformed HTTP/2 control frames, or malformed flow, in order to make the server reset streams created by the client (using the RST_STREAM frame). \nThe vulnerability could be triggered by several primitives, defined by the RFC of HTTP/2 (RFC 9113). The Primitives are:\n1. WINDOW_UPDATE frame with an increment of 0 or an increment that makes the window exceed 2^31 - 1. (section 6.9 + 6.9.1)\n2. HEADERS or DATA frames sent on a half-closed (remote) stream (which was closed using the END_STREAM flag). (note that for some implementations it's possible a CONTINUATION frame to trigger that as well - but it's very rare). (Section 5.1)\n3. PRIORITY frame with a length other than 5. (section 6.3)\nFrom our experience, the primitives are likely to exist in the decreasing order listed above.\nNote that based on the implementation of the library, other primitives (which are not defined by the RFC) might exist - meaning scenarios in which RST_STREAM is not supposed to be sent, but in the implementation it does. On the other hand - some RFC-defined primitives might not work, even though they are defined by the RFC (as some implementations are not fully complying with RFC). For example, some implementations we’ve seen discard the PRIORITY frame - and thus does not return RST_STREAM, and some implementations send GO_AWAY when receiving a WINDOW_UPDATE frame with increment of 0.\n\nThe vulnerability takes advantage of a design flaw in the HTTP/2 protocol - While HTTP/2 has a limit on the number of concurrently active streams per connection (which is usually 100, and is set by the parameter SETTINGS_MAX_CONCURRENT_STREAMS), the number of active streams is not counted correctly - when a stream is reset, it is immediately considered not active, and thus unaccounted for in the active streams counter. \nWhile the protocol does not count those streams as active, the server’s backend logic still processes and handles the requests that were canceled.\n\nThus, the attacker can exploit this vulnerability to cause the server to handle an unbounded number of concurrent streams from a client on the same connection. The exploitation is very simple: the client issues a request in a stream, and then sends the control frame that causes the server to send a RST_STREAM.\n\n### Attack Flow\nFor example, a possible attack scenario can be: \n1. Attacker opens an HTTP/2 connection to the server.\n2. Attacker sends HEADERS frame with END_STREAM flag on a new stream X.  \n3. Attacker sends WINDOW_UPDATE for stream X with flow-control window of 0.\n4. The server receives the WINDOW_UPDATE and immediately sends RST_STREAM for stream X to the client (+ decreases the active streams counter by 1).\n\nThe attacker can repeat steps 2+3 as rapidly as it is capable, since the active streams counter never exceeds 1 and the attacker does not need to wait for the response from the server.\nThis leads to resource exhaustion and distributed denial of service vulnerabilities with an impact of: CPU overload and/or memory exhaustion (implementation dependant)\n\n### Comparison to Rapid Reset\nThe vulnerability takes advantage of a design flow in the HTTP/2 protocol that was also used in the Rapid Reset vulnerability (CVE-2023-44487) which was exploited as a zero-day in the wild in August 2023 to October 2023, against multiple services and vendors.\nThe Rapid Reset vulnerability uses RST_STREAM frames sent from the client, in order to create an unbounded amount of concurrent streams - it was given a CVSS score of 7.5.\nRapid Reset was mostly mitigated by limiting the number/rate of RST_STREAM sent from the client, which does not mitigate the MadeYouReset attack - since it triggers the server to send a RST_STREAM.\n\n### Suggested Mitigations for MadeYouReset\nA quick and easy mitigation will be to limit the number/rate of RST_STREAMs sent from the server.\nIt is also possible to limit the number/rate of control frames sent by the client (e.g. WINDOW_UPDATE and PRIORITY), and treat protocol flow errors as a connection error.\n\nAs mentioned in our previous message, this is a protocol-level vulnerability that affects multiple vendors and implementations. Given its broad impact, it is the shared responsibility of all parties involved to handle the disclosure process carefully and coordinate mitigations effectively.\n\n\nIf you have any questions, we will be happy to clarify or schedule a Zoom call.\n\nGal, Anat and Yaniv.\n\n\n\n## Jetty's Team Notes\n\n### Impact\nA denial of service vulnerability similar to [Rapid Reset](https://github.com/jetty/jetty.project/security/advisories/GHSA-c745-7wm4-7738), but where the client triggers a reset from the server by sending a malformed or invalid frame.\nIn particular, this may be triggered by WINDOW_UPDATE frames that are invalid (e.g. with `delta==0` or when the delta makes the window exceed `2^31-1`).\n\n### Patches\nPatch has been merged into 12.0.x mainline via https://github.com/jetty/jetty.project/pull/13449.\n\n### Workarounds\nNo workarounds apart disabling HTTP/2.","status":"published","published":"2025-08-20T20:52:17Z","modified":"2025-11-05T20:40:35Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T14:39:07.0252Z"}],"nvd":[{"id":"CVE-2025-5115","description":"In Eclipse Jetty, versions \u003c=9.4.57, \u003c=10.0.25, \u003c=11.0.25, \u003c=12.0.21, \u003c=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.\n\n\nFor example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal.\nPer specification  https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame.\nThe client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.\n\n\nThe attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.\n\n\n\nLinks:\n\n\n\n  *   https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h","status":"published","published":"2025-08-20T20:15:33.377Z","modified":"2026-06-17T09:47:13.537Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"primary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:11:25.261243Z"}],"osv":[{"id":"CVE-2025-5115","title":"MadeYouReset HTTP/2 vulnerability","description":"In Eclipse Jetty, versions \u003c=9.4.57, \u003c=10.0.25, \u003c=11.0.25, \u003c=12.0.21, \u003c=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.\n\n\nFor example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal.\nPer specification  https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame.\nThe client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.\n\n\nThe attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.\n\n\n\nLinks:\n\n\n\n  *   https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h","status":"published","published":"2025-08-20T19:07:11.546Z","modified":"2026-10-28T02:30:41.100692256Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:50.45326Z"},{"id":"DEBIAN-CVE-2025-5115","description":"In Eclipse Jetty, versions \u003c=9.4.57, \u003c=10.0.25, \u003c=11.0.25, \u003c=12.0.21, \u003c=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory.   For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification  https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time.   The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame.    Links:      *   https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h","status":"published","published":"2025-08-20T20:15:33.377Z","modified":"2026-09-01T20:05:53.637031152Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:47.378563Z"},{"id":"GHSA-58qw-p7qm-5rvh","title":"Eclipse Jetty XmlParser allows arbitrary DOCTYPE declarations","description":"### From the reporter\n\n\u003e `XmlParser` is vulnerable to XML external entity (XXE) vulnerability.\n\u003e  XmlParser is being used when parsing Jetty’s xml configuration files. An attacker might exploit\n\u003e this vulnerability in order to achieve SSRF or cause a denial of service.\n\u003e One possible scenario is importing a (remote) malicious WAR into a Jetty’s server, while the\n\u003e WAR includes a malicious web.xml.\n\n### Impact\nThere are no circumstances in a normally deployed Jetty server where potentially hostile XML is given to the XmlParser class without the attacker already having arbitrary access to the server. I.e. in order to exploit `XmlParser` the attacker would already have the ability to deploy and execute hostile code.  Specifically, Jetty has no protection against malicious web application and potentially hostile web applications should only be run on an isolated virtualisation.  \n\nThus this is not considered a vulnerability of the Jetty server itself, as any such usage of the jetty XmlParser is equally vulnerable as a direct usage of the JVM supplied SAX parser.  No CVE will be allocated to this advisory.\n\nHowever, any direct usage of the `XmlParser` class by an application may be vulnerable.  The impact would greatly depend on how the application uses `XmlParser`, but it could be a denial of service due to large entity expansion, or possibly the revealing local files if the XML results are accessible remotely.\n\n### Patches\nAbility to configure the SAXParserFactory to fit the needs of your particular XML parser implementation have been merged as part of PR #10067\n\n### Workarounds\nDon't use Jetty's `XmlParser` to parse data from users.","status":"published","published":"2023-07-10T21:52:39Z","modified":"2026-09-10T03:50:08.640067019Z","cvss":[{"version":"3.1","score":3.9,"vector":"CVSS:3.1/AV:L/AC:H/PR:H/UI:N/S:U/C:L/I:L/A:L","level":"low"}],"cwes":["CWE-611"],"updated_at":"2026-11-02T15:46:38.213481Z"},{"id":"GHSA-mmxm-8w33-wc4h","title":"Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability","description":"## Technical Details \nBelow is a technical explanation of a newly discovered vulnerability in HTTP/2, which we refer to as “MadeYouReset.”\n\n### MadeYouReset Vulnerability Summary\nThe MadeYouReset DDoS vulnerability is a logical vulnerability in the HTTP/2 protocol, that uses malformed HTTP/2 control frames in order to break the max concurrent streams limit - which results in resource exhaustion and distributed denial of service.\n\n### Mechanism\nThe vulnerability uses malformed HTTP/2 control frames, or malformed flow, in order to make the server reset streams created by the client (using the RST_STREAM frame). \nThe vulnerability could be triggered by several primitives, defined by the RFC of HTTP/2 (RFC 9113). The Primitives are:\n1. WINDOW_UPDATE frame with an increment of 0 or an increment that makes the window exceed 2^31 - 1. (section 6.9 + 6.9.1)\n2. HEADERS or DATA frames sent on a half-closed (remote) stream (which was closed using the END_STREAM flag). (note that for some implementations it's possible a CONTINUATION frame to trigger that as well - but it's very rare). (Section 5.1)\n3. PRIORITY frame with a length other than 5. (section 6.3)\nFrom our experience, the primitives are likely to exist in the decreasing order listed above.\nNote that based on the implementation of the library, other primitives (which are not defined by the RFC) might exist - meaning scenarios in which RST_STREAM is not supposed to be sent, but in the implementation it does. On the other hand - some RFC-defined primitives might not work, even though they are defined by the RFC (as some implementations are not fully complying with RFC). For example, some implementations we’ve seen discard the PRIORITY frame - and thus does not return RST_STREAM, and some implementations send GO_AWAY when receiving a WINDOW_UPDATE frame with increment of 0.\n\nThe vulnerability takes advantage of a design flaw in the HTTP/2 protocol - While HTTP/2 has a limit on the number of concurrently active streams per connection (which is usually 100, and is set by the parameter SETTINGS_MAX_CONCURRENT_STREAMS), the number of active streams is not counted correctly - when a stream is reset, it is immediately considered not active, and thus unaccounted for in the active streams counter. \nWhile the protocol does not count those streams as active, the server’s backend logic still processes and handles the requests that were canceled.\n\nThus, the attacker can exploit this vulnerability to cause the server to handle an unbounded number of concurrent streams from a client on the same connection. The exploitation is very simple: the client issues a request in a stream, and then sends the control frame that causes the server to send a RST_STREAM.\n\n### Attack Flow\nFor example, a possible attack scenario can be: \n1. Attacker opens an HTTP/2 connection to the server.\n2. Attacker sends HEADERS frame with END_STREAM flag on a new stream X.  \n3. Attacker sends WINDOW_UPDATE for stream X with flow-control window of 0.\n4. The server receives the WINDOW_UPDATE and immediately sends RST_STREAM for stream X to the client (+ decreases the active streams counter by 1).\n\nThe attacker can repeat steps 2+3 as rapidly as it is capable, since the active streams counter never exceeds 1 and the attacker does not need to wait for the response from the server.\nThis leads to resource exhaustion and distributed denial of service vulnerabilities with an impact of: CPU overload and/or memory exhaustion (implementation dependant)\n\n### Comparison to Rapid Reset\nThe vulnerability takes advantage of a design flow in the HTTP/2 protocol that was also used in the Rapid Reset vulnerability (CVE-2023-44487) which was exploited as a zero-day in the wild in August 2023 to October 2023, against multiple services and vendors.\nThe Rapid Reset vulnerability uses RST_STREAM frames sent from the client, in order to create an unbounded amount of concurrent streams - it was given a CVSS score of 7.5.\nRapid Reset was mostly mitigated by limiting the number/rate of RST_STREAM sent from the client, which does not mitigate the MadeYouReset attack - since it triggers the server to send a RST_STREAM.\n\n### Suggested Mitigations for MadeYouReset\nA quick and easy mitigation will be to limit the number/rate of RST_STREAMs sent from the server.\nIt is also possible to limit the number/rate of control frames sent by the client (e.g. WINDOW_UPDATE and PRIORITY), and treat protocol flow errors as a connection error.\n\nAs mentioned in our previous message, this is a protocol-level vulnerability that affects multiple vendors and implementations. Given its broad impact, it is the shared responsibility of all parties involved to handle the disclosure process carefully and coordinate mitigations effectively.\n\n\nIf you have any questions, we will be happy to clarify or schedule a Zoom call.\n\nGal, Anat and Yaniv.\n\n\n\n## Jetty's Team Notes\n\n### Impact\nA denial of service vulnerability similar to [Rapid Reset](https://github.com/jetty/jetty.project/security/advisories/GHSA-c745-7wm4-7738), but where the client triggers a reset from the server by sending a malformed or invalid frame.\nIn particular, this may be triggered by WINDOW_UPDATE frames that are invalid (e.g. with `delta==0` or when the delta makes the window exceed `2^31-1`).\n\n### Patches\nPatch has been merged into 12.0.x mainline via https://github.com/jetty/jetty.project/pull/13449.\n\n### Workarounds\nNo workarounds apart disabling HTTP/2.","status":"published","published":"2025-08-20T20:52:17Z","modified":"2026-09-10T03:50:27.451213618Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","level":"high"}],"cwes":["CWE-400","CWE-770"],"updated_at":"2026-11-02T15:46:52.170928Z"},{"id":"RHSA-2025:16454","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.19 OpenShift Jenkins security update","status":"published","published":"2025-09-23T10:04:44Z","modified":"2026-09-25T10:03:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:16455","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 Openshift Jenkins security update","status":"published","published":"2025-09-23T10:04:45Z","modified":"2026-09-25T10:03:02Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:16456","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update","status":"published","published":"2025-09-23T10:04:45Z","modified":"2026-09-25T10:03:03Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:16457","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update","status":"published","published":"2025-09-23T10:04:46Z","modified":"2026-09-25T10:03:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:16459","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update","status":"published","published":"2025-09-23T10:04:46Z","modified":"2026-09-25T10:03:04Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:16460","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update","status":"published","published":"2025-09-24T10:05:52Z","modified":"2026-09-25T10:03:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:16461","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update","status":"published","published":"2025-09-24T10:05:52Z","modified":"2026-09-25T10:03:05Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"RHSA-2025:16462","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update","status":"published","published":"2025-09-24T10:05:53Z","modified":"2026-09-25T10:03:06Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:16.096024Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-5115","title":"CVE-2025-5115 in org.eclipse.jetty.http2:jetty-http2-common - Patched by Root","description":"Root has patched CVE-2025-5115 in the org.eclipse.jetty.http2:jetty-http2-common package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-14T12:22:49Z","modified":"2026-08-14T14:45:11.534669239Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2025-5115","description":"In Eclipse Jetty, versions \u003c=9.4.57, \u003c=10.0.25, \u003c=11.0.25, \u003c=12.0.21, \u003c=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory. For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time. The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame. Links:   * https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h","status":"published","published":"2025-08-20T20:15:00Z","modified":"2026-10-17T12:57:05.82564487Z","cvss":[{"version":"4.0","score":7.7,"vector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:50.31802Z"},{"id":"CLSA-2026-1770163741","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.59.tuxcare00001.","status":"published","published":"2026-08-04T14:52:07Z","modified":"2026-10-30T19:45:05.748698682Z","updated_at":"2026-11-02T15:43:43.249928Z"},{"id":"CLSA-2026-1773879458","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.60.tuxcare0001.","status":"published","published":"2026-08-04T14:52:13Z","modified":"2026-10-30T19:45:02.838481183Z","updated_at":"2026-11-02T15:43:43.621843Z"},{"id":"CLSA-2026-1775781157","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.61.tuxcare0001.","status":"published","published":"2026-08-04T14:52:23Z","modified":"2026-10-30T19:45:02.851052421Z","updated_at":"2026-11-02T15:43:44.009773Z"},{"id":"CLSA-2026-1779065189","title":"TuxCare security update for 24 packages (9 CVEs)","description":"TuxCare rebuilt 24 packages to address 9 CVEs. Fixed in 9.4.41.v20210516-tuxcare.1.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-15T09:45:14.379063591Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779065207","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.62.tuxcare0001.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-10-30T19:45:22.253882231Z","updated_at":"2026-11-02T15:43:44.737408Z"},{"id":"CLSA-2026-1779151632","title":"TuxCare security update for 2 packages (5 CVEs)","description":"TuxCare rebuilt 2 packages to address 5 CVEs. Fixed in 9.4.24.v20191120-tuxcare.2.","status":"published","published":"2026-08-04T14:52:32Z","modified":"2026-11-02T19:45:31.378618085Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1779842949","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.57.v20241219-tuxcare.1.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-11-02T19:45:30.816760671Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1779842950","title":"TuxCare security update for 5 packages (5 CVEs)","description":"TuxCare rebuilt 5 packages to address 5 CVEs. Fixed in 9.4.48.v20220622-tuxcare.2.","status":"published","published":"2026-08-04T14:52:34Z","modified":"2026-11-02T19:45:31.791639216Z","updated_at":"2026-11-02T20:30:18.404297Z"},{"id":"CLSA-2026-1786553094","title":"TuxCare security update for org.eclipse.jetty.http2:http2-common (1 CVE)","description":"TuxCare rebuilt org.eclipse.jetty.http2:http2-common to address 1 CVE. Fixed in 9.4.53.v20231009-tuxcare.7.","status":"published","published":"2026-08-12T16:44:54Z","modified":"2026-11-02T19:45:55.644772318Z","updated_at":"2026-11-02T20:30:00.884471Z"},{"id":"CLSA-2026-1788878815","title":"TuxCare security update for 2 packages (2 CVEs)","description":"TuxCare rebuilt 2 packages to address 2 CVEs. Fixed in 9.4.50.v20221201-tuxcare.5.","status":"published","published":"2026-09-08T14:46:55Z","modified":"2026-11-02T19:46:14.347445025Z","updated_at":"2026-11-02T20:29:33.792105Z"},{"id":"CLSA-2026-1792753531","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 11.0.18-tuxcare.1.","status":"published","published":"2026-10-23T11:05:31Z","modified":"2026-11-02T19:46:31.49054063Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1792756836","title":"TuxCare security update for 3 packages (4 CVEs)","description":"TuxCare rebuilt 3 packages to address 4 CVEs. Fixed in 11.0.19-tuxcare.4.","status":"published","published":"2026-10-23T12:00:36Z","modified":"2026-11-02T19:46:31.630808482Z","updated_at":"2026-11-02T20:28:59.01272Z"},{"id":"CLSA-2026-1793132217","title":"TuxCare security update for 9 packages (5 CVEs)","description":"TuxCare rebuilt 9 packages to address 5 CVEs. Fixed in 12.0.22-tuxcare.1.","status":"published","published":"2026-10-27T20:16:57Z","modified":"2026-11-02T19:46:32.652202463Z","updated_at":"2026-11-02T20:28:42.34712Z"},{"id":"CLSA-2026-1794182179","title":"TuxCare security update for 3 packages (3 CVEs)","description":"TuxCare rebuilt 3 packages to address 3 CVEs. Fixed in 10.0.26-tuxcare.4.","status":"published","published":"2026-11-09T00:56:20Z","modified":"2026-11-09T07:15:05.131895149Z","updated_at":"2026-11-09T07:20:29.20536Z"},{"id":"CLSA-2026-1794251641","title":"TuxCare security update for 5 packages (5 CVEs)","description":"TuxCare rebuilt 5 packages to address 5 CVEs. Fixed in 9.4.51.v20230217-tuxcare.2.","status":"published","published":"2026-11-09T20:14:02Z","modified":"2026-11-10T01:15:05.398922343Z","updated_at":"2026-11-10T01:43:20.132342Z"},{"id":"DLA-4299-1","title":"jetty9 - security update","status":"published","published":"2025-09-14T00:00:00Z","modified":"2026-03-09T02:09:55.160174Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-6005-1","title":"jetty9 - security update","status":"published","published":"2025-09-19T00:00:00Z","modified":"2026-03-09T02:11:08.272097Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"DSA-6006-1","title":"jetty12 - security update","status":"published","published":"2025-09-19T00:00:00Z","modified":"2026-03-09T02:09:55.101596Z","updated_at":"2026-11-02T15:46:18.296714Z"},{"id":"openSUSE-SU-2025:15482-1","title":"jetty-annotations-9.4.58-1.1 on GA media","description":"These are all security issues fixed in the jetty-annotations-9.4.58-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-08-22T00:00:00Z","modified":"2026-03-23T04:53:50.515664Z","updated_at":"2026-11-02T16:58:37.810934Z"},{"id":"SUSE-SU-2025:02993-1","title":"Security update for jetty-minimal","description":"This update for jetty-minimal fixes the following issues:\n\nUpgraded to version 9.4.58.v20250814:\n- CVE-2025-5115: Fixed MadeYouReset DoS attack via HTTP/2 protocol (including DNS over HTTPS) (bsc#1244252)\n","status":"published","published":"2025-09-01T14:04:07Z","modified":"2026-03-23T04:48:42.561785Z","updated_at":"2026-11-02T15:53:57.111474Z"},{"id":"SUSE-SU-2025:02993-2","title":"Security update for jetty-minimal","description":"This update for jetty-minimal fixes the following issues:\n\nUpgraded to version 9.4.58.v20250814:\n- CVE-2025-5115: Fixed MadeYouReset DoS attack via HTTP/2 protocol (including DNS over HTTPS) (bsc#1244252)\n","status":"published","published":"2025-09-01T14:04:07Z","modified":"2026-03-23T04:49:51.208046Z","updated_at":"2026-11-02T15:53:57.111474Z"}]}}