HTTP/2 denial of service vulnerability in bundled Jetty

🗓️ 17 Sep 2025 00:00:00Reported by Jenkins Security TeamType

Jenkins bundles Jetty vulnerable to CVE-2025-5115; HTTP/2 DoS risk; upgrade to 2.524 or disable HTTP/2.

Reporter	Title	Published	Views	Family All 147
IBM Security Bulletins	Security Bulletin: Security Vulnerability in Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2025-5115)	21 Jul 202618:43	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Storage Protect Server is affected by a vulnerability in the Eclipse http2-common library that could cause resource exhaustion (CVE-2025-5115).	1 Aug 202603:57	–	ibm
IBM Security Bulletins	Security Bulletin: Due to the use of eclipse Jetty Rational Performance Tester is vulnerable to a denial of service	2 Jan 202618:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.3	7 Oct 202516:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by a single vulnerability (CVE-2025-5115)	23 Apr 202618:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis is affected by improper resource management due to Eclipse Jetty	11 Jun 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Eclipse Jetty (CVE-2025-5115)	29 Sep 202521:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in http2-common (CVE-2025-5115)	10 Mar 202610:18	–	ibm
AstraLinux	Astra Linux – Vulnerability in Jetty9	20 May 202605:53	–	astralinux
FreeBSD	jenkins -- multiple vulnerabilities	17 Sep 202500:00	–	freebsd