Denial of Service in Eclipse Jetty HTTP/2 Server Implementation
CVE-2022-2048

7.5HIGH

Key Information:

Vendor: The Eclipse Foundation
Status: Eclipse Jetty
Vendor: CVE Published:; 7 July 2022

🔔 Create The Eclipse Foundation Vulnerability Alert

What is CVE-2022-2048?

In the Eclipse Jetty HTTP/2 server implementation, there exists a flaw in error handling when processing invalid HTTP/2 requests. This oversight can lead to failure in properly releasing active connections and their associated resources. As a result, this vulnerability may enable an attacker to exhaust server resources, thereby preventing legitimate requests from being processed, which creates a denial of service scenario.