In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:HEclipse Jetty
APPEclipse10.0.0 – 10.0.911.0.0 – 11.0.9
🟢
PATCH AVAILABLE
Vendor update available. Deploy in standard maintenance cycle.
Related vulnerabilities
CVE-2019-17638CRITICAL9.4ten sam produkt
In Eclipse Jetty, versions 9.4.27.v20200227 to 9.4.29.v20200521, in case of too large response headers, Jetty ...
CVE-2017-7657CRITICAL9.8ten sam produkt
In Eclipse Jetty, versions 9.2.x and older, 9.3.x (all configurations), and 9.4.x (non-default configuration w...
CVE-2017-7658CRITICAL9.8ten sam produkt
In Eclipse Jetty Server, versions 9.2.x and older, 9.3.x (all non HTTP/1.x configurations), and 9.4.x (all HTT...
CVE-2016-4800CRITICAL9.8ten sam produkt
The path normalization mechanism in PathResource class in Eclipse Jetty 9.3.x before 9.3.9 on Windows allows r...
CVE-2023-44487HIGH7.5⚠ KEVten sam produkt
The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can ...