Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

Exploitation

No confirmed exploitation recorded. Patch Next marks exploitation only from CISA KEV.

CVSS

7.5 · CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS

• CVE-2021-28165: 53.86% estimated exploitation activity in the next 30 days; percentile 99.00 (FIRST EPSS, 2026-11-03). This is a model estimate, not proof of exploitation or customer exposure.

As published by the source; long descriptions are shortened.

Impact When using SSL/TLS with Jetty, either with HTTP/1.1, HTTP/2, or WebSocket, the server may receive an invalid large (greater than 17408) TLS frame that is incorrectly handled, causing CPU resources to eventually reach 100% usage. Workarounds The problem can be worked around by compiling the following class: This class can be deployed by: + The resulting class file should be put into a jar file (eg sslfix6072.jar) + The jar file should be made available to the server. For a normal distribution this can be done by putting the file into ${jetty.base}/lib + Copy the file ${jetty.home}/modules/ssl.mod to ${jetty.base}/modules + Edit the ${jetty.base}/modules/ssl.mod file to have the following section: + Copy the file ${jetty.home}/etc/jetty-https.xml and${jetty.home}/etc/jetty-http2.xml to ${jetty.base}/etc + Edit files ${jetty.base}/etc/jetty-https.xml and ${jetty.base}/etc/jetty-http2.xml, changing any reference of org.eclipse.jetty.server.SslConnectionFactory to…

Published by the source

6 Apr 2021, 17:31 UTC

Last modified by the source

26 Sep 2023, 11:11 UTC

Source last checked

26 Oct 2026, 16:12 UTC

1. Revision 1 · created · 26 Oct 2026

   Published from ghsa record GHSA-26vr-8j45-3r4w

Preview the exact text before you copy it. Commands are read-only suggestions; review them before running anything.

# Patch Next advisory brief: CVE-2021-28165

Advisory: Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources
IDs: CVE-2021-28165, GHSA-26vr-8j45-3r4w
Record: https://patchnext.com/advisories/cve-2021-28165 (revision 1, source checked 26 Oct 2026, 16:12 UTC)
Inventory: none attached. This brief comes from a public page and does not say whether any deployment is affected.
Severity: High (CVSS 7.5)
Exploitation: no confirmed exploitation recorded. Patch Next confirms exploitation only from CISA KEV.
Vendor response: Vendor fix available; fixed versions by package: org.eclipse.jetty:jetty-server 11.0.2, 10.0.2, 9.4.39. A vendor fix does not mean a deployment is fixed.

## Affected components
- Maven org.eclipse.jetty:jetty-server: affected >= 7.2.2, < 9.4.39; >= 10.0.0, < 10.0.2; >= 11.0.0, < 11.0.2; fixed in 9.4.39, 11.0.2, 10.0.2

## Suggested inspection (read-only)
- Maven org.eclipse.jetty:jetty-server: check the installed version with your package manager.

## Supported action
Upgrade each affected component to a fixed version on its release line. For a transitive dependency, upgrade the parent package or add an override or constraint, then regenerate the lockfile. Redeploy every environment that ran an affected version.

## Required regression checks
- Run the test suite and a production build.
- Exercise the features that depend on org.eclipse.jetty:jetty-server.
- Repeat the inspection and confirm that only fixed versions remain installed.

## Rollback considerations
- Keep the previous lockfile and deployment artifact. Rolling back reinstates the vulnerable version, so apply any documented mitigation while you fix forward.

## Unresolved questions
- Which deployments run an affected version?
- Exploitation status can change. Check again before lowering the priority.
- Mark the work resolved only after the fixed version is verified in production.

## Sources
- Verified: https://github.com/advisories/GHSA-26vr-8j45-3r4w (GitHub-reviewed advisory GHSA-26vr-8j45-3r4w lists affected ranges: Maven org.eclipse.jetty:jetty-server >=7.2.2 =10.0.0 =11.0.0 <11.0.2)

Commands are suggestions: review each one before running it.