Search for packages
Package details: pkg:maven/org.eclipse.jetty.http2/jetty-http2-common@12.0.6
purl pkg:maven/org.eclipse.jetty.http2/jetty-http2-common@12.0.6
Next non-vulnerable version 12.0.17
Latest non-vulnerable version 12.0.17
Risk 4.0
Vulnerabilities affecting this package (1)
Vulnerability Summary Fixed by
VCID-ugcc-yrb8-9qg6
Aliases:
CVE-2025-1948
GHSA-889j-63jv-qhr8
Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit ### Original Report In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting. ### Impact Remote peers can cause the JVM to crash or continuously report OOM. ### Patches 12.0.17 ### Workarounds No workarounds. ### References https://github.com/jetty/jetty.project/issues/12690
12.0.17
Affected by 0 other vulnerabilities.
Vulnerabilities fixed by this package (1)
Vulnerability Summary Aliases
VCID-ggqc-qjf8-aaad Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6. CVE-2024-22201
GHSA-rggv-cv7r-mw98

Date Actor Action Vulnerability Source VulnerableCode Version
2025-06-20T17:21:14.298353+00:00 GitLab Importer Affected by VCID-ugcc-yrb8-9qg6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2025-1948.yml 36.1.3
2025-06-20T16:54:00.947118+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 36.1.3
2025-06-08T23:53:14.632667+00:00 GitLab Importer Affected by VCID-ugcc-yrb8-9qg6 https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2025-1948.yml 36.1.0
2025-06-03T23:31:04.006677+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 36.1.0
2025-06-02T23:28:53.065735+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 36.1.2
2025-05-01T08:20:24.825110+00:00 GHSA Importer Fixing VCID-ggqc-qjf8-aaad https://github.com/advisories/GHSA-rggv-cv7r-mw98 36.0.0
2025-04-04T11:32:38.065365+00:00 GithubOSV Importer Fixing VCID-ggqc-qjf8-aaad https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-rggv-cv7r-mw98/GHSA-rggv-cv7r-mw98.json 36.0.0
2025-03-28T16:49:16.326325+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 36.0.0
2025-02-18T03:47:14.796316+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 35.1.0
2024-11-21T01:02:27.710021+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 35.0.0
2024-11-19T00:50:59.383905+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 34.3.2
2024-10-15T19:21:21.832292+00:00 GithubOSV Importer Fixing VCID-ggqc-qjf8-aaad https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-rggv-cv7r-mw98/GHSA-rggv-cv7r-mw98.json 34.0.2
2024-10-08T01:22:38.837766+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 34.0.2
2024-10-07T21:56:41.825258+00:00 GHSA Importer Fixing VCID-ggqc-qjf8-aaad https://github.com/advisories/GHSA-rggv-cv7r-mw98 34.0.2
2024-09-18T09:18:46.198356+00:00 GithubOSV Importer Fixing VCID-ggqc-qjf8-aaad https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-rggv-cv7r-mw98/GHSA-rggv-cv7r-mw98.json 34.0.1
2024-09-17T22:42:33.464128+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 34.0.1
2024-09-17T22:00:55.061502+00:00 GHSA Importer Fixing VCID-ggqc-qjf8-aaad https://github.com/advisories/GHSA-rggv-cv7r-mw98 34.0.1
2024-04-23T23:12:52.794284+00:00 GithubOSV Importer Fixing VCID-ggqc-qjf8-aaad https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2024/02/GHSA-rggv-cv7r-mw98/GHSA-rggv-cv7r-mw98.json 34.0.0rc4
2024-04-23T17:43:27.221635+00:00 GitLab Importer Fixing VCID-ggqc-qjf8-aaad https://gitlab.com/gitlab-org/advisories-community/-/blob/main/maven/org.eclipse.jetty.http2/jetty-http2-common/CVE-2024-22201.yml 34.0.0rc4
2024-04-23T17:39:58.104982+00:00 GHSA Importer Fixing VCID-ggqc-qjf8-aaad https://github.com/advisories/GHSA-rggv-cv7r-mw98 34.0.0rc4