The vulnerability of Eclipse Jetty servlet containers, related to resource exhaustion, allows attackers to trigger a service failure.

🗓️ 15 Oct 2025 00:00:00Reported by FSTEC of Russia — Information Security Threat DatabaseType

Eclipse Jetty servlet containers have a resource exhaustion vulnerability that can trigger failures.

Reporter	Title	Published	Views	Family All 322
IBM Security Bulletins	Security Bulletin: Security Vulnerability in Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-5115)	27 Aug 202623:07	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse http2-common library that could cause resource exhaustion (CVE-2025-5115).	1 Aug 202603:57	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of eclipse Jetty Rational Performance Tester is vulnerable to a denial of service	2 Jan 202618:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.3	7 Oct 202516:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by a single vulnerability (CVE-2025-5115)	23 Apr 202618:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Optim 1.0.0, 1.1.0 and 1.2.0 impacted by vulnerabilities in webkit2gtk3-jsc 2.50.4-1.el9_7, gstreamer1-plugins-base 1.22.12-4.el9, jetty-io 11.0.24, zookeeper 3.9.3, jackson-core 2.12.7, aircompressor 2.0.2, libtiff 4.4.0-1	21 Sep 202616:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis is affected by improper resource management due to Eclipse Jetty	11 Jun 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Eclipse Jetty (CVE-2025-5115)	29 Sep 202521:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in http2-common (CVE-2025-5115)	10 Mar 202610:18	–	ibm
AstraLinux	Astra Linux – Vulnerability in Jetty9	14 Sep 202612:01	–	astralinux

Vulners

Node

eclipse jettyMatch12.1.0.alpha0

eclipse jettyMatch12.1.0.alpha1

eclipse jettyMatch12.1.0.alpha2

eclipse jettyRange≤9.4.57

eclipse jettyRange10.0.0–10.0.25

eclipse jettyRange11.0.0–11.0.25

eclipse jettyRange12.0.0–12.0.21

Source	Link
github	www.github.com/jetty/jetty.project/pull/13449
github	www.github.com/jetty/jetty.project/releases/tag/jetty-10.0.26
github	www.github.com/jetty/jetty.project/releases/tag/jetty-11.0.26
github	www.github.com/jetty/jetty.project/releases/tag/jetty-12.0.25
github	www.github.com/jetty/jetty.project/releases/tag/jetty-12.1.0
github	www.github.com/jetty/jetty.project/releases/tag/jetty-9.4.58.v20250814
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h
redos	www.redos.red-soft.ru/support/secure/
xn--80ahaefyxhn	www.xn--80ahaefyxhn.xn--j1afgaq.xn--p1ai/bin/view/%D0%9E%D0%A1%D0%BD%D0%BE%D0%B2%D0%B0/%D0%9E%D0%B1%D0%BD%D0%BE%D0%B2%D0%BB%D0%B5%D0%BD%D0%B8%D1%8F/3.1/
web	www.web.nvd.nist.gov/view/vuln/detail

04 Mar 2026 00:00Current

7High risk

Vulners AI Score7

CVSS 37.5

CVSS 27.8

EPSS0.03457