CVE-2021-28165

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Affected

The Eclipse Foundation · Eclipse Jetty

CVSS v3.1 NVD

7.5 HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

CVSS v2.0 NVD

7.8 HIGHAV:N/AC:L/Au:N/C:N/I:N/A:C

EPSS

53.86% chance of exploitation in the next 30 days, 99th percentile

Published

2021-04-01

Updated

2025-08-27

Proof-of-concept exploits (1)

• uthrasri/CVE-2021-281650★ · 2023-11-02

Security advisories

• http://www.openwall.com/lists/oss-security/2021/04/20/3
• eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w
• https://security.netapp.com/advisory/ntap-20210611-0006
• https://www.debian.org/security/2021/dsa-4949
• https://www.oracle.com//security-alerts/cpujul2021.html
• https://www.oracle.com/security-alerts/cpuapr2022.html
• https://www.oracle.com/security-alerts/cpujan2022.html
• https://www.oracle.com/security-alerts/cpuoct2021.html
• advisories/GHSA-26vr-8j45-3r4w

References

• CVE Record
• NVD entry

Related

• CVE-2014-3566
• CVE-2014-3570
• CVE-2014-5139
• CVE-2014-8275
• CVE-2019-16746
• CVE-2019-17666