CVE-2024-22201: debian debian_linux Uncontrolled Resource Consumption
Vulnerability summary
CVE-2024-22201 is a high (CVSS 7.5) Uncontrolled Resource Consumption vulnerability in debian debian_linux. EPSS estimates a 1.43% chance of exploitation in the next 30 days, higher than 72.6% of scored vulnerabilities.
Advisory lineage
Upstream 0 · Downstream 4 · Related 3Timeline
- 26-02-2024PublishedVulnerability first disclosed.
- 13-02-2025Last modifiedVulnerability information updated.
Description
Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it times out. An attacker can cause many connections to end up in this state, and the server may run out of file descriptors, eventually causing the server to stop accepting new connections from valid clients. The vulnerability is patched in 9.4.54, 10.0.20, 11.0.20, and 12.0.6.
CVSS metrics
7 scores · 7 sources · 1 version- OSV · UbuntuEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · DebianEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · WolfiEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · ChainguardEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- OSV · MavenEcosystem advisory · calculated7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
- NVDNIST7.5HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
EPSS trend
Probability
1.43%
Chance of exploitation in the next 30 days
Percentile
73%
Versus all other CVEs
30-day change
0.00 pp
From 1.43% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root cause- CWE-400Uncontrolled Resource ConsumptionThe product does not properly control the allocation and maintenance of a limited resource.
- CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
Affected systems
Suse12 products
- jetty-minimal&distro=SUSE Enterprise Storage 7.1< 9.4.54-150200.3.25.1
- jetty-minimal&distro=SUSE Linux Enterprise High Performance Computing 15 SP2-LTSS< 9.4.54-150200.3.25.1
- jetty-minimal&distro=SUSE Linux Enterprise High Performance Computing 15 SP3-LTSS< 9.4.54-150200.3.25.1
- jetty-minimal&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-ESPOS< 9.4.54-150200.3.25.1
- jetty-minimal&distro=SUSE Linux Enterprise High Performance Computing 15 SP4-LTSS< 9.4.54-150200.3.25.1
Chainguard2 products
- solr< 9.5.0-r1
- solr-oci-compat< 9.5.0-r1
Debian2 products
- jetty9< 9.4.54-1 | < 9.4.50-4+deb11u2 | < 9.4.50-4+deb12u3 | < 9.4.50-4+deb10u2
- debian_linuxEOL10.0
Netapp2 products
Org.eclipse.jetty.http22 products
- http2-common≥ 9.3.0, < 9.4.54 | ≥ 10.0.0, < 10.0.20 | ≥ 11.0.0, < 11.0.20
- jetty-http2-common≥ 12.0.0, < 12.0.6
Org.eclipse.jetty.http32 products
- http3-common≥ 10.0.8, < 10.0.20 | ≥ 11.0.8, < 11.0.20
- jetty-http3-common≥ 12.0.0, < 12.0.6
Wolfi2 products
- solr< 9.5.0-r1
- solr-oci-compat< 9.5.0-r1
Eclipse1 product
- jetty≥ 9.3.0, < 9.4.54 | ≥ 10.0.0, < 10.0.20 | ≥ 11.0.0, < 11.0.20 | ≥ 12.0.0, < 12.0.6
Jetty1 product
- jetty.project≥ 9.3.0, ≤ 9.4.53 | ≥ 10.0.0, ≤ 10.0.19 | ≥ 11.0.0, ≤ 11.0.19 | ≥ 12.0.0, ≤ 12.0.5
Opensuse1 product
- jetty-minimal&distro=openSUSE Leap 15.5< 9.4.54-150200.3.25.1
Ubuntu1 product
- jettyAll versions (No fix recorded)
11 vendors · 28 products
References
18 links- github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98X Refsource CONFIRMREPORTAdvisoryWEBVendor Advisory
