Connection leaking on idle timeout when TCP congested

🗓️ 26 Feb 2024 20:13:46Reported by GitHub Advisory DatabaseType

github

github🔗 github.com👁 43 Views

HTTP/2 connection leaking on TCP congestion

Reporter	Title	Published	Views	Family All 121
IBM Security Bulletins	Security Bulletin: Vulnerability in Eclipse Jetty affects IBM Process Mining CVE-2024-22201	29 Mar 202410:40	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues	15 Apr 202505:41	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operational Decision Manager for May 2024 - Multiple CVEs addressed	14 Jun 202409:53	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities in IBM MQ affect IBM Robotic Process Automation.	14 Oct 202404:13	–	ibm
IBM Security Bulletins	Security Bulletin: IBM MQ is affected by a vulnerability in Eclipse Jetty (CVE-2024-22201)	27 Jun 202400:28	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues	29 Oct 202420:40	–	ibm
IBM Security Bulletins	Security Bulletin: Rational Performance Tester contains vulnerabilities which could affect Eclipse Jetty.	30 Jul 202417:23	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Observability with Instana (OnPrem) is affected by multiple security vulnerabilities	5 Jun 202512:19	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities affect Apache Solr shipped with IBM Operations Analytics - Log Analysis (CVE-2024-22201, CVE-2023-51775)	4 Sep 202415:29	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple Vulnerabilities in Rational Change	8 Oct 202413:07	–	ibm

Vulners

Node

org.eclipse.jetty.http3 jetty-http3-commonRange12.0.0–12.0.5maven

OR

org.eclipse.jetty.http2 jetty-http2-commonRange12.0.0–12.0.5maven

OR

org.eclipse.jetty.http3 http3-commonRange11.0.8–11.0.19maven

OR

org.eclipse.jetty.http2 http2-commonRange11.0.0–11.0.19maven

OR

org.eclipse.jetty.http3 http3-commonRange10.0.8–10.0.19maven

OR

org.eclipse.jetty.http2 http2-commonRange10.0.0–10.0.19maven

OR

org.eclipse.jetty.http2 http2-commonRange9.3.0–9.4.53maven

Source	Link
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-rggv-cv7r-mw98
nvd	www.nvd.nist.gov/vuln/detail/CVE-2024-22201
github	www.github.com/jetty/jetty.project/issues/11256
github	www.github.com/jetty/jetty.project/issues/11259
github	www.github.com/jetty/jetty.project/commit/0839a208cdc3fcfe25206a77af59ba9fda260188
github	www.github.com/jetty/jetty.project/commit/b953871c9a5ff4fbca4a2499848f75182dbd9810
security	www.security.netapp.com/advisory/ntap-20240329-0001
lists	www.lists.debian.org/debian-lts-announce/2024/04/msg00002.html
openwall	www.openwall.com/lists/oss-security/2024/03/20/2
github	www.github.com/advisories/GHSA-rggv-cv7r-mw98

14 Mar 2026 05:09Current

7.3High risk

Vulners AI Score7.3

CVSS 3.17.5

EPSS0.00559

SSVC

CWE-400 CWE-770

impact idle timeout tcp congested goaway frame file descriptors server http/1.x jetty