HTTP/2 denial of service vulnerability in bundled Jetty

🗓️ 17 Sep 2025 00:00:00Reported by Jenkins Security TeamType

Jenkins bundles Jetty vulnerable to CVE-2025-5115; HTTP/2 DoS risk; upgrade to 2.524 or disable HTTP/2.

Reporter	Title	Published	Views	Family All 137
IBM Security Bulletins	Security Bulletin: Due to the use of eclipse Jetty Rational Performance Tester is vulnerable to a denial of service	2 Jan 202618:01	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.0.3	7 Oct 202516:08	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Guardium Data Protection is affected by a single vulnerability (CVE-2025-5115)	23 Apr 202618:04	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Operations Analytics - Log Analysis is affected by improper resource management due to Eclipse Jetty	11 Jun 202615:34	–	ibm
IBM Security Bulletins	Security Bulletin: IBM InfoSphere Information Server is affected by a vulnerability in Eclipse Jetty (CVE-2025-5115)	29 Sep 202521:11	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in http2-common (CVE-2025-5115)	10 Mar 202610:18	–	ibm
AstraLinux	Astra Linux - уязвимость в jetty9	20 May 202605:53	–	astralinux
FreeBSD	jenkins -- multiple vulnerabilities	17 Sep 202500:00	–	freebsd
Chainguard	CVE-2025-5115 vulnerabilities	21 Aug 202513:17	–	cgr
Circl	CVE-2025-5115	20 Aug 202519:47	–	circl