PT-2021-7302 · Eclipse+5 · Eclipse Jetty+5

Published

2021-04-01

·

Updated

2026-03-10

·

CVE-2021-28165

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 7.2.2 through 9.4.38 Eclipse Jetty versions 10.0.0.alpha0 through 10.0.1 Eclipse Jetty versions 11.0.0.alpha0 through 11.0.1
Description The issue is related to an uncontrolled resource consumption in Eclipse Jetty, which can cause CPU usage to reach 100% upon receiving a large invalid TLS frame. This can be exploited by a remote attacker to cause a denial of service. The problem occurs when using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, and the server receives an invalid large TLS frame that is incorrectly handled.
Recommendations For Eclipse Jetty versions 7.2.2 through 9.4.38, 10.0.0.alpha0 through 10.0.1, and 11.0.0.alpha0 through 11.0.1, a workaround can be applied by compiling and deploying the SpaceCheckingSslConnectionFactory class, which checks for encrypted buffer max length exceeded and throws an SSLHandshakeException. This class can be deployed by putting the resulting class file into a jar file, making it available to the server, and editing the ssl.mod and jetty-https.xml files to reference the new class. Restart Jetty after applying the changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Resource Exhaustion

Improper Handling of Exceptional Conditions

Weakness Enumeration

Related Identifiers

ALT-PU-2021-2000
BDU:2022-05507
BIT-JENKINS-2021-28165
CVE-2021-28165
DSA-4949-1
GHSA-26VR-8J45-3R4W
OESA-2021-1166
OPENSUSE-SU-2021:2005-1
OPENSUSE-SU-2021_2005-1
OPENSUSE-SU-2024:10878-1
RHSA-2021:1509
RHSA-2021:1551
SUSE-SU-2021:2005-1

Affected Products

Alt Linux
Astra Linux
Eclipse Jetty
Jenkins
Jira
Suse