GHSA-26vr-8j45-3r4w · Severity: high · Ecosystem: maven — Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
Conclusion & alert: CVE-2021-28165 is rated High Exploit Risk (84.6/100): CVSS High severity, with high exploitation likelihood (EPSS 53.86%, 99th percentile). Core evidence: 1 public exploit reference(s) are indexed (Exploit-DB). EPSS rose +40.28% over the last day, indicating growing attacker interest. Mandatory action: Public exploits are available—assess exposure, apply mitigations, and prioritize patching.
Risk is dynamic; we continuously reassess and refresh what is shown on this page as upstream context changes.
| EDB-ID | Source | Kind | Published | Link |
|---|---|---|---|---|
| — | nvd_ref | exploit_tag | Exploit-DB ↗ |
EPSS lead: Daily EPSS estimates relative likelihood of exploitation; percentile ranks this CVE among scored vulnerabilities (higher = more severe relative rank).
| # | Date | Old EPSS score | New EPSS score | Delta (New - Old) |
|---|---|---|---|---|
| 1 | 2026-06-15 | 13.58% | 53.86% | +40.28% |
| 2 | 2026-05-22 | 11.99% | 13.58% | +1.59% |
| 3 | 2026-04-10 | — | 11.99% | — |
Full EPSS history (97 records total)
CVSS metrics for this CVE.
| Base score | Version | Severity | Vector | Exploitability | Impact | Score source |
|---|---|---|---|---|---|---|
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | [email protected] |
| 7.5 | 3.1 | HIGH |
|
3.9 | 3.6 | 134c704f-9b21-4f2e-91b3-4a467353bcc0 |
| 7.8 | 2.0 | HIGH |
|
10.0 | 6.9 | [email protected] |
GHSA-26vr-8j45-3r4w · Severity: high · Ecosystem: maven — Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
| vendor | priority | summary | link |
|---|---|---|---|
debian
|
not yet assigned | CVE-2021-28165 not yet assigned priority: Debian including 1 source packages (jetty9), 5 status rows across 5 suites (bookworm, bullseye, forky, sid, trixie): resolved 5. | https://security-tracker.debian.org/tracker/CVE-2021-28165 |
redhat
|
medium | — | https://access.redhat.com/security/cve/CVE-2021-28165 |
suse
|
high | CVE-2021-28165 severity important: SUSE including 57 source package names (jetty-annotations-9.4.42-3.9.1, jetty-annotations-9.4.43-1.2, …), 200 product×package rows across 15 product lines (Image server-image, SUSE Linux Enterprise Module for Development Tools 15 SP2, … (15 product lines)): Fixed 200. | https://www.suse.com/security/cve/CVE-2021-28165/ |
ubuntu
|
medium | CVE-2021-28165 medium priority: Ubuntu including 1 source packages (equinox-bundles), 16 status rows across 16 suites (bionic, focal, groovy, hirsute, impish, jammy, kinetic, lunar, mantic, noble, oracular, plucky, questing, trusty, upstream, xenial): DNE 7, ignored 5, needs-triage 4. | https://ubuntu.com/security/CVE-2021-28165 |
| Vendor | Product | Version | Raw CPE |
|---|---|---|---|
| eclipse | jetty | >= 7.2.2, < 9.4.39 | cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* |
| eclipse | jetty | >= 10.0.0, < 10.0.2 | cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* |
| eclipse | jetty | >= 11.0.0, < 11.0.2 | cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* |
| oracle | autovue_for_agile_product_lifecycle_management | 21.0.2 | cpe:2.3:a:oracle:autovue_for_agile_product_lifecycle_management:21.0.2:*:*:*:*:*:*:* |
| oracle | communications_cloud_native_core_policy | 1.14.0 | cpe:2.3:a:oracle:communications_cloud_native_core_policy:1.14.0:*:*:*:*:*:*:* |
| oracle | communications_element_manager | 8.2.2 | cpe:2.3:a:oracle:communications_element_manager:8.2.2:*:*:*:*:*:*:* |
| oracle | communications_services_gatekeeper | 7.0 | cpe:2.3:a:oracle:communications_services_gatekeeper:7.0:*:*:*:*:*:*:* |
| oracle | communications_session_report_manager | >= 8.0.0.0, <= 8.2.4.0 | cpe:2.3:a:oracle:communications_session_report_manager:*:*:*:*:*:*:*:* |
| oracle | communications_session_route_manager | >= 8.0.0.0, <= 8.2.4.0 | cpe:2.3:a:oracle:communications_session_route_manager:*:*:*:*:*:*:*:* |
| oracle | rest_data_services | < 21.3 | cpe:2.3:a:oracle:rest_data_services:*:*:*:*:*:*:*:* |
| oracle | siebel_core_-_automation | <= 21.9 | cpe:2.3:a:oracle:siebel_core_-_automation:*:*:*:*:*:*:*:* |
| jenkins | jenkins | < 2.277.3 | cpe:2.3:a:jenkins:jenkins:*:*:*:*:lts:*:*:* |
| jenkins | jenkins | < 2.286 | cpe:2.3:a:jenkins:jenkins:*:*:*:*:*:*:*:* |
| netapp | cloud_manager | < 3.9.8 | cpe:2.3:a:netapp:cloud_manager:*:*:*:*:*:*:*:* |
| netapp | e-series_performance_analyzer | < 3.0 | cpe:2.3:a:netapp:e-series_performance_analyzer:*:*:*:*:*:*:*:* |
| netapp | e-series_santricity_os_controller | >= 11.0.0, < 11.70.1 | cpe:2.3:a:netapp:e-series_santricity_os_controller:*:*:*:*:*:*:*:* |
| netapp | e-series_santricity_storage | < 1.10 | cpe:2.3:a:netapp:e-series_santricity_storage:*:*:*:*:*:vcenter:*:* |
| netapp | e-series_santricity_web_services | < 5.1 | cpe:2.3:a:netapp:e-series_santricity_web_services:*:*:*:*:*:web_services_proxy:*:* |
| netapp | ontap_tools | < 9.10 | cpe:2.3:a:netapp:ontap_tools:*:*:*:*:*:vmware_vsphere:*:* |
| netapp | santricity_cloud_connector | — | cpe:2.3:a:netapp:santricity_cloud_connector:-:*:*:*:*:*:*:* |
| netapp | santricity_web_services_proxy | < 5.1 | cpe:2.3:a:netapp:santricity_web_services_proxy:*:*:*:*:*:*:*:* |
| netapp | snapcenter | < 4.6 | cpe:2.3:a:netapp:snapcenter:*:*:*:*:*:*:*:* |
| netapp | storage_replication_adapter_for_clustered_data_ontap | < 9.10 | cpe:2.3:a:netapp:storage_replication_adapter_for_clustered_data_ontap:*:*:*:*:*:vmware_vsphere:*:* |
| netapp | vasa_provider_for_clustered_data_ontap | < 9.10 | cpe:2.3:a:netapp:vasa_provider_for_clustered_data_ontap:*:*:*:*:*:*:*:* |