CVE-2021-28165

🗓️ 01 Apr 2021 14:20:14Reported by eclipseType

cve🔗 web.nvd.nist.gov📰️ 10 Media mentions👁 546 Views

Eclipse Jetty CPU usage can reach 100% due to large invalid TLS fram

Reporter	Title	Published	Views	Family All 135
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is vulnerable to various attacks due to Eclipse jetty	21 Jun 202318:36	–	ibm
IBM Security Bulletins	Security Bulletin: Common Vulnerabilities in Cloudera Data Platform Private Cloud Base 7.1.9.	7 May 202419:59	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in eclipse jetty affect IBM Business Automation Workflow	3 Jun 202413:36	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Cognos Command Center is affected by multiple vulnerabilities	4 May 202320:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is vulnerable to multiple Eclipse Jetty issues	24 Jun 202216:32	–	ibm
IBM Security Bulletins	Security Bulletin: Vulnerability in Eclipse Jetty affects IBM Process Mining (CVE-2021-28165)	1 Feb 202321:57	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in Eclipse Jetty affect IBM InfoSphere Information Server	17 May 202302:32	–	ibm
IBM Security Bulletins	Security Bulletin: A CVE-2021-28165 vulnerability in Eclipse Jetty affects IBM Process Designer 8.5.7 shipped with IBM Business Automation Workflow	12 Apr 202321:48	–	ibm
IBM Security Bulletins	Security Bulletin: An Eclipse Jetty vulnerability affects IBM Rational Functional Tester	29 Mar 202206:27	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in Eclipse Jetty affect IBM Security Directory Integrator	15 May 202400:45	–	ibm

NVD

Node

eclipse jettyRange7.2.2–9.4.39

eclipse jettyRange10.0.0–10.0.2

eclipse jettyRange11.0.0–11.0.2

Node

oracle autovue_for_agile_product_lifecycle_managementMatch21.0.2

oracle communications_cloud_native_core_policyMatch1.14.0

oracle communications_element_managerMatch8.2.2

oracle communications_services_gatekeeperMatch7.0

oracle communications_session_report_managerRange8.0.0.0–8.2.4.0

oracle communications_session_route_managerRange8.0.0.0–8.2.4.0

oracle rest_data_servicesRange<21.3

oracle siebel_core_-_automationRange≤21.9

Node

jenkins jenkinsRange<2.277.3lts

jenkins jenkinsRange<2.286

Node

netapp cloud_managerRange<3.9.8

netapp e-series_performance_analyzerRange<3.0

netapp e-series_santricity_os_controllerRange11.0.0–11.70.1

netapp e-series_santricity_storageRange<1.10vcenter

netapp e-series_santricity_web_servicesRange<5.1web_services_proxy

netapp ontap_toolsRange<9.10vmware_vsphere

netapp santricity_cloud_connectorMatch-

netapp santricity_web_services_proxyRange<5.1

netapp snapcenterRange<4.6

netapp storage_replication_adapter_for_clustered_data_ontapRange<9.10vmware_vsphere

netapp vasa_provider_for_clustered_data_ontapRange<9.10

[
  {
    "product": "Eclipse Jetty",
    "vendor": "The Eclipse Foundation",
    "versions": [
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "7.2.2",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "9.4.38",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "10.0.0.alpha0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "10.0.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      },
      {
        "lessThan": "unspecified",
        "status": "affected",
        "version": "11.0.0.alpha0",
        "versionType": "custom"
      },
      {
        "lessThanOrEqual": "11.0.1",
        "status": "affected",
        "version": "unspecified",
        "versionType": "custom"
      }
    ]
  }
]

Source	Link
lists	www.lists.apache.org/thread.html/r9db72e9c33b93eba45a214af588f1d553839b5c3080fc913854a49ab%40%3Cnotifications.zookeeper.apache.org%3E
lists	www.lists.apache.org/thread.html/rc6c43c3180c0efe00497c73dd374cd34b62036cb67987ad42c1f2dce%40%3Creviews.spark.apache.org%3E
lists	www.lists.apache.org/thread.html/r72bf813ed4737196ea3ed26494e949577be587fd5939fe8be09907c7%40%3Creviews.spark.apache.org%3E
lists	www.lists.apache.org/thread.html/r2ea2f0541121f17e470a0184843720046c59d4bde6d42bf5ca6fad81%40%3Cissues.solr.apache.org%3E
openwall	www.openwall.com/lists/oss-security/2021/04/20/3
lists	www.lists.apache.org/thread.html/r2afc72af069a7fe89ca2de847f3ab3971cb1d668a9497c999946cd78%40%3Ccommits.spark.apache.org%3E
github	www.github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w
lists	www.lists.apache.org/thread.html/r90327f55db8f1d079f9a724aabf1f5eb3c00c1de49dc7fd04cad1ebc%40%3Ccommits.pulsar.apache.org%3E
lists	www.lists.apache.org/thread.html/rbab9e67ec97591d063905bc7d4743e6a673f1bc457975fc0445ac97f%40%3Cissues.hbase.apache.org%3E
lists	www.lists.apache.org/thread.html/rdf4fe435891e8c35e70ea5da033b4c3da78760f15a8c4212fad89d9f%40%3Ccommits.zookeeper.apache.org%3E

27 Aug 2025 21:15Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

CVSS 27.8

EPSS0.13581

SSVC

eclipse jetty cpu usage 100%invalid tls frame cve-2021-28165 nvd