Search for vulnerabilities
Vulnerability details: VCID-ggqc-qjf8-aaad
Vulnerability ID VCID-ggqc-qjf8-aaad
Aliases CVE-2024-22201
GHSA-rggv-cv7r-mw98
Summary Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
Status Published
Exploitability 0.5
Weighted Severity 8.0
Risk 4.0
Affected and Fixed Packages Package Details
Weaknesses (4)
CWE-400 Uncontrolled Resource Consumption
CWE-937 OWASP Top Ten 2013 Category A9 - Using Components with Known Vulnerabilities
CWE-1035 OWASP Top Ten 2017 Category A9 - Using Components with Known Vulnerabilities
CWE-770 Allocation of Resources Without Limits or Throttling
System Score Found at
cvssv3 7.5 https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22201.json
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00045 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00264 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00264 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00264 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00264 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00264 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00264 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00269 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00293 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00293 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.00301 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.02816 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
epss 0.07492 https://api.first.org/data/v1/epss?cve=CVE-2024-22201
cvssv3.1 7.5 https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
cvssv3.1_qr HIGH https://github.com/advisories/GHSA-rggv-cv7r-mw98
cvssv3.1 5.3 https://github.com/jetty/jetty.project
cvssv3.1 7.5 https://github.com/jetty/jetty.project
generic_textual HIGH https://github.com/jetty/jetty.project
generic_textual MODERATE https://github.com/jetty/jetty.project
cvssv3.1 7.5 https://github.com/jetty/jetty.project/commit/0839a208cdc3fcfe25206a77af59ba9fda260188
generic_textual HIGH https://github.com/jetty/jetty.project/commit/0839a208cdc3fcfe25206a77af59ba9fda260188
cvssv3.1 7.5 https://github.com/jetty/jetty.project/commit/b953871c9a5ff4fbca4a2499848f75182dbd9810
generic_textual HIGH https://github.com/jetty/jetty.project/commit/b953871c9a5ff4fbca4a2499848f75182dbd9810
cvssv3.1 7.5 https://github.com/jetty/jetty.project/issues/11256
generic_textual HIGH https://github.com/jetty/jetty.project/issues/11256
cvssv3.1 7.5 https://github.com/jetty/jetty.project/issues/11259
generic_textual HIGH https://github.com/jetty/jetty.project/issues/11259
cvssv3.1 7.5 https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
cvssv3.1_qr HIGH https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
cvssv3.1_qr HIGH https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
generic_textual HIGH https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
cvssv3.1 7.5 https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html
generic_textual HIGH https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html
cvssv3.1 7.5 https://nvd.nist.gov/vuln/detail/CVE-2024-22201
generic_textual HIGH https://nvd.nist.gov/vuln/detail/CVE-2024-22201
cvssv3.1 7.5 https://security.netapp.com/advisory/ntap-20240329-0001
generic_textual HIGH https://security.netapp.com/advisory/ntap-20240329-0001
cvssv3.1 7.5 http://www.openwall.com/lists/oss-security/2024/03/20/2
generic_textual HIGH http://www.openwall.com/lists/oss-security/2024/03/20/2
Reference id Reference type URL
https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22201.json
https://api.first.org/data/v1/epss?cve=CVE-2024-22201
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-22201
https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
https://github.com/jetty/jetty.project
https://github.com/jetty/jetty.project/commit/0839a208cdc3fcfe25206a77af59ba9fda260188
https://github.com/jetty/jetty.project/commit/b953871c9a5ff4fbca4a2499848f75182dbd9810
https://github.com/jetty/jetty.project/issues/11256
https://github.com/jetty/jetty.project/issues/11259
https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html
https://security.netapp.com/advisory/ntap-20240329-0001
https://security.netapp.com/advisory/ntap-20240329-0001/
http://www.openwall.com/lists/oss-security/2024/03/20/2
1064923 https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=1064923
2266136 https://bugzilla.redhat.com/show_bug.cgi?id=2266136
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:linux:*:*
cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:active_iq_unified_manager:-:*:*:*:*:windows:*:*
cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:a:netapp:bluexp:-:*:*:*:*:*:*:*
cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:* https://nvd.nist.gov/vuln/search/results?adv_search=true&isCpeNameSearch=true&query=cpe:2.3:o:debian:debian_linux:10.0:*:*:*:*:*:*:*
CVE-2024-22201 https://nvd.nist.gov/vuln/detail/CVE-2024-22201
GHSA-rggv-cv7r-mw98 https://github.com/advisories/GHSA-rggv-cv7r-mw98
RHSA-2024:3634 https://access.redhat.com/errata/RHSA-2024:3634
RHSA-2024:3635 https://access.redhat.com/errata/RHSA-2024:3635
RHSA-2024:3636 https://access.redhat.com/errata/RHSA-2024:3636
RHSA-2024:4597 https://access.redhat.com/errata/RHSA-2024:4597
No exploits are available.
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://access.redhat.com/hydra/rest/securitydata/cve/CVE-2024-22201.json
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://ftp.suse.com/pub/projects/security/yaml/suse-cvss-scores.yaml
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L Found at https://github.com/jetty/jetty.project
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jetty/jetty.project
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jetty/jetty.project/commit/0839a208cdc3fcfe25206a77af59ba9fda260188
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jetty/jetty.project/commit/b953871c9a5ff4fbca4a2499848f75182dbd9810
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jetty/jetty.project/issues/11256
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jetty/jetty.project/issues/11259
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://lists.debian.org/debian-lts-announce/2024/04/msg00002.html
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://nvd.nist.gov/vuln/detail/CVE-2024-22201
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at https://security.netapp.com/advisory/ntap-20240329-0001
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H Found at http://www.openwall.com/lists/oss-security/2024/03/20/2
Attack Vector (AV) Attack Complexity (AC) Privileges Required (PR) User Interaction (UI) Scope (S) Confidentiality Impact (C) Integrity Impact (I) Availability Impact (A)

network

adjacent_network

local

physical

low

high

none

low

high

none

required

unchanged

changed

high

low

none

high

low

none

high

low

none
Exploit Prediction Scoring System (EPSS)
Percentile 0.16666
EPSS Score 0.00045
Published At Nov. 1, 2024, midnight
Date Actor Action Source VulnerableCode Version
2024-04-23T17:18:29.267587+00:00 NVD Importer Import https://nvd.nist.gov/vuln/detail/CVE-2024-22201 34.0.0rc4