CVE-2021-28165

The Eclipse Foundation Eclipse Jetty

HIGH 7.5

At a glance

Source: NVD
EPSS: EPSS 53.86 % · percentile 99 (2026-10-28)
State: PUBLISHED
Published: 2021-04-01 14:20 UTC
Updated: 2025-08-27 20:37 UTC
Assigner: eclipse
NVD status: Modified

Description

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Weaknesses (CWE)

CWE-400 — Uncontrolled Resource Consumption
CWE-551 — Incorrect Behavior Order: Authorization Before Parsing and Canonicalization
CWE-755 — Improper Handling of Exceptional Conditions

References

Scores

Version	Score	Vector	Scored by
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	eclipse
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	CISA-ADP
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · emo@eclipse.org (Secondary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · nvd@nist.gov (Primary)
CVSS 3.1	HIGH 7.5	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	NVD · 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)
CVSS 2.0	HIGH 7.8	AV:N/AC:L/Au:N/C:N/I:N/A:C	NVD · nvd@nist.gov (Primary)

Advisories

GHSA-26vr-8j45-3r4w — Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

European references

ENISA EUVD · EUVD-2021-0735
GCVE · GCVE-0-2021-28165

CERT-FR advisories

CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
CERTFR-2023-AVI-0357 — Multiples vulnérabilités dans IBM Cognos · cert.ssi.gouv.fr
CERTFR-2022-AVI-916 — Multiples vulnérabilités dans les produits Juniper · cert.ssi.gouv.fr
CERTFR-2022-AVI-767 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2022-AVI-551 — Multiples vulnérabilités dans Zimbra · cert.ssi.gouv.fr
CERTFR-2022-AVI-523 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
CERTFR-2021-AVI-912 — Multiples vulnérabilités dans IBM Qradar · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 7.2.2 < 9.4.39
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 10.0.0 < 10.0.2
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.0.2
cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:*
cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* ≥ 8.0.0.0 ≤ 8.2.4.0
cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* ≥ 8.0.0.0 ≤ 8.2.4.0
cpe:2.3:a:oracle:rest_data_services:*:*:*:*:*:*:*:* < 21.3
cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:* ≤ 21.9
cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* < 2.277.3
cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* < 2.286
cpe:2.3:a:netapp:cloud_manager:*:*:*:*:*:*:*:* < 3.9.8
cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:* < 3.0
cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* ≥ 11.0.0 < 11.70.1
cpe:2.3:a:netapp:e-series_santricity_storage:*:*:*:*:*:vcenter:*:* < 1.10
cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:* < 5.1
cpe:2.3:a:netapp:ontap_tools:*:*:*:*:*:vmware_vsphere:*:* < 9.10
cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:*
cpe:2.3:a:netapp:santricity_web_services_proxy:*:*:*:*:*:*:*:* < 5.1
cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:* < 4.6
cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:* < 9.10
cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:* < 9.10

Affected products

Product	Versions
The Eclipse Foundation · Eclipse Jetty	affected 7.2.2 < unspecified ; affected unspecified ≤ 9.4.38 ; affected 10.0.0.alpha0 < unspecified ; affected unspecified ≤ 10.0.1 ; affected 11.0.0.alpha0 < unspecified ; affected unspecified ≤ 11.0.1

Sources

Source	Licence
CVE List (CVEProject cvelistV5)	CVE Program Terms of Use
EPSS (FIRST.org)	FIRST — attribution requested
ENISA EUVD	ENISA — reproduction authorised, source acknowledged
CERT-FR (ANSSI)	Licence Ouverte / Etalab 2.0
NVD (NIST) via fkie-cad/nvd-json-data-feeds	Public domain — this product uses data from the NVD API but is not endorsed or certified by the NVD