CoreCVE
Back

HIGH

Jetty connection leaking on idle timeout when TCP congested

Published Feb 26, 2024

Description

Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.

Affected products

Remediation

Red Hat statement

The issue in Jetty where HTTP/2 connections can enter a congested, idle state and potentially exhaust server file descriptors represents a moderate severity due to its impact on system resources and service availability. While the vulnerability requires the deliberate creation of numerous congested connections by an attacker, its exploitation can lead to denial-of-service conditions by consuming all available file descriptors. This scenario could disrupt legitimate client connections and impair server responsiveness.

Red Hat mitigation

Mitigation for this issue is either not available or the currently available options don't meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability.

Metrics

Weaknesses (2)

CWE-400

Uncontrolled Resource Consumption

CWE-770

Allocation of Resources Without Limits

References (13)

Change history (0)

No recorded changes yet.

Sources
CVE.org / MITRE
Status PUBLISHED
Assigner GitHub_M
Published Feb 26, 2024
Updated Feb 13, 2025
Reserved Jan 8, 2024
Link CVE-2024-22201
CISA Vulnrichment
Updated Apr 1, 2024
NVD
Status Modified
Modified Jun 17, 2026
Link CVE-2024-22201
Red Hat
Severity Moderate
Public date Feb 26, 2024
Links CVE-2024-22201 - Bugzilla
GHSA-RGGV-CV7R-MW98