CVE-2021-28165: eclipse jetty Uncontrolled Resource Consumption
Modified
AliasesUBUNTU-CVE-2021-28165DEBIAN-CVE-2021-28165CGA-3hc5-4wr7-q3xrCGA-4cgf-p56f-qpq6CGA-4gxh-j3wr-fjxwCGA-6672-hgc4-vrwpCGA-85cf-q7rf-726mCGA-92xw-pc32-3j9xCGA-93h4-3qr3-jj8mCGA-9cpg-g6cq-jphjCGA-g7h7-j62v-28qcCGA-g7m6-pqfg-r8rmCGA-hpw5-p924-9wpgCGA-j6cg-cw6p-3w9vCGA-p4wc-fv6p-2wh7GHSA-26vr-8j45-3r4wBIT-jenkins-2021-28165CGA-q26g-82gh-rj68CGA-rfcq-6j2h-cm7cCGA-rh49-q4rf-vm8qCGA-rhqg-w8fc-4fh2CGA-vpjm-rgr5-gvg4CGA-xgf4-f774-gx4cCGA-xm74-w3x3-gw5c
Published 01-04-2021Last modified 27-08-2025
Vulnerability summary
CVE-2021-28165 is a high (CVSS 7.8) Uncontrolled Resource Consumption vulnerability in eclipse jetty. EPSS estimates a 53.86% chance of exploitation in the next 30 days, higher than 99% of scored vulnerabilities. 1 public exploit is recorded.
Priority
Prioritisepublic exploit
Public exploit (GitHub, Date unknown)
Source freshness unavailable
How is this decided?CVSS score
7.8/10
010
High · v2.0 (NVD)EPSS score
53.86%
0%100%
Critical · 0.00 pp in 30 daysKEVNot listedNot listed by any tracked catalog.
RansomwareNot flaggedNo ransomware use recorded.
Public exploits1github
Advisory lineage
Upstream 0 · Downstream 5 · Related 2Timeline
- 01-04-2021PublishedVulnerability first disclosed.
- 27-08-2025Last modifiedVulnerability information updated.
Description
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
CVSS metrics
7 scores · 6 sources · 2 versionsHigh 7.5Preferred score · CVE.org (CNA)
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HSourcesAll 6 agree
- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
High 7.8Preferred score · NVD (NIST)
AV:N/AC:L/Au:N/C:N/I:N/A:CSourcesSingle source
EPSS trend
Probability
53.86%
Chance of exploitation in the next 30 days
Percentile
99%
Versus all other CVEs
30-day change
No change 0.00 pp
From 53.86% on 04-10-2026
04-10-202603-11-2026
Known exploited
Compare KEV catalogs
CISA KEVNot in the CISA KEV catalog.
ENISA CNWNot in the ENISA CNW catalog.
CIRCLNot in the CIRCL catalog.
Public exploits
1 foundJetty.Project
Maturity: poc
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-551Incorrect Behavior Order: Authorization Before Parsing and CanonicalizationIf a web server does not fully parse requested URLs before it examines them for authorization, it may be possible for an attacker to bypass authorization protection.
- CWE-755Improper Handling of Exceptional ConditionsThe product does not handle or incorrectly handles an exceptional condition.
Affected systems
Version check
Known conditions: network-reachable, no authentication, no user interaction (CVSS vector). Other conditions: not stated in public data.
Netapp11 products
- cloud_manager< 3.9.8
- e-series_performance_analyzer< 3.0
- e-series_santricity_os_controller≥ 11.0.0, < 11.70.1
- e-series_santricity_storage< 1.10
- e-series_santricity_web_services< 5.1
Oracle8 products
- autovue_for_agile_product_lifecycle_management21.0.2
- communications_cloud_native_core_policy1.14.0
- communications_element_manager8.2.2
- communications_services_gatekeeper7.0
- communications_session_report_manager≥ 8.0.0.0, ≤ 8.2.4.0
Chainguard3 products
- hadoop-fips-3.3.6All versions (No fix recorded)
- hadoop-fips-3.4.2All versions (No fix recorded)
- hadoop-fips-3.5All versions (No fix recorded)
Debian1 product
- jetty9< 9.4.39-1
Eclipse1 product
- jetty≥ 7.2.2, < 9.4.39 | ≥ 10.0.0, < 10.0.2 | ≥ 11.0.0, < 11.0.2
Jenkins1 product
- jenkins< 2.277.3 | < 2.286
Org.eclipse.jetty1 product
- jetty-server≥ 7.2.2, < 9.4.39 | ≥ 10.0.0, < 10.0.2 | ≥ 11.0.0, < 11.0.2
The eclipse foundation1 product
- eclipse jetty≥ 7.2.2, < unspecified | ≥ unspecified, ≤ 9.4.38 | ≥ 10.0.0.alpha0, < unspecified | ≥ unspecified, ≤ 10.0.1 | ≥ 11.0.0.alpha0, < unspecified | ≥ unspecified, ≤ 11.0.1
Ubuntu1 product
- equinox-bundlesAll versions (No fix recorded)
9 vendors · 28 products
References
212 links- github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4wX Refsource CONFIRMREPORTEVIDENCEWEBExploitThird Party Advisory
Show all 100 references
- www.openwall.com/lists/oss-security/2021/04/20/3Mailing ListX Refsource MLISTAdvisoryWEBThird Party Advisory
Showing 100 of 212.