VRT Sign in

High Oracle Communications Signaling (Eclipse Jetty) CVEs

3 CVEs, 1 exploited

Look up CVE IDs Status Exploitation Severity

Reset

Overview 3 matches · 0 protected · 1 exploited · 1 CISA KEV · 1 public PoC · 1 EPSS ≥ 0.5

3matches 0protected0.0% 1exploited33.3% 1CISA KEV33.3% 1public PoC33.3% 1EPSS ≥ 0.533.3%

Protected by Waratek 0 0.0% Rule in development 0 0.0% Mitigation candidate 1 33.3% No exploit published 2 66.7%

Critical 0 0.0% High 3 100.0% Medium 0 0.0% Low 0 0.0% None 0 0.0% Unknown 0 0.0%

blocked by ARMR today 0 0.0% partly blocked 0 0.0% not blocked 3 100.0% not established 0 0.0% unrecorded 0 0.0%

Exploited 1 33.3% Working exploit published 0 0.0% Proof of concept only 0 0.0% Forecast only 0 0.0% No public exploit 2 66.7%

split by StatusSeverityProtectionExploit maturity peak 2 / month

Jul 222 No exploit published2 High2 not blocked2 No public exploit2 Aug 220 Sep 220 Oct 220 Nov 220 Dec 220 Jan 230 Feb 230 Mar 230 Apr 230 May 230 Jun 230 Jul 230 Aug 230 Sep 230 Oct 231 Mitigation candidate1 High1 not blocked1 Exploited1

Aug 22Oct 22Dec 22Feb 23Apr 23Jun 23Aug 23Oct 23

3 matches Sign in to download these CVEs as CSV or JSON, or to follow them in a feed.

CVE	Severity	Published▾	Status	Exploitation	Description
CVE-2023-44487	High	2023-10-10	Mitigation candidate	Exploited	The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.
CVE-2022-2191	High	2022-07-07	No exploit published	No public exploit	In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
CVE-2022-2048	High	2022-07-07	No exploit published	No public exploit	In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

CVE

Severity

Published▾

Status

Exploitation

Description

CVE-2023-44487

High

2023-10-10

Mitigation candidate

Exploited

The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as exploited in the wild in August through October 2023.

CVE-2022-2191

High

2022-07-07

No exploit published

No public exploit

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

CVE-2022-2048

High

2022-07-07

No exploit published

No public exploit

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.