© 2026 vulntracker.io

CVE-2022-2048

HIGH

7.5

CVSS Score

Published: July 7, 2022 at 08:35 PM UTC

Updated: June 17, 2026 at 04:41 AM UTC

8 products affected across 4 vendorsDebian LinuxSnapCenterJenkins

Using Eclipse Jetty by The Eclipse Foundation?

Get instant alerts when new vulnerabilities affect Eclipse Jetty - before attackers find them.

Real-time alertsTrack your software stackFree plan available

Start Free Sign In

Severity

HIGH7.5

Exploit prediction

EPSS 3%

Description

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

Affected

Our own answer: ranges merged, affected separated from platform-only, with confidence and review flags.

Debian Linux · Debiandrupal

95%

Jetty · Eclipsemaven

95%

v ≥ 10.0.0v ≥ 11.0.0v ≥ 9.4.0v ≤ 10.0.9v ≤ 11.0.9v ≤ 9.4.46v < 9.4.4710.0.0 ≤ v < 10.0.911.0.0 ≤ v < 11.0.910.0.0 11.0.0 9.4.0

Affected range stops below 10.0.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 11.0.9, so it looks safe — our inference, not a vendor statement

Affected range stops below 9.4.47, so it looks safe — our inference, not a vendor statement

Jenkins · Jenkinsjenkins-plugin

95%

v < 2.263v < 2.361.1

Affected range stops below 2.263, so it looks safe — our inference, not a vendor statement

Affected range stops below 2.361.1, so it looks safe — our inference, not a vendor statement

Element Plug in for Vcenter Server · NetApp

95%

All versions

Hci Compute Node · NetApp

95%

All versions

Management Services for Element Software and NetApp HCI · NetApp

95%

All versions

SnapCenter · NetAppdrupal

95%

All versions

Solidfire & Hci Storage Node · NetApp

95%

All versions

Remediation

No guide yet

No remediation guidance has been written for this CVE yet. What the record does show:

Patch and advisory references

https://www.debian.org/security/2022/dsa-5198

References (5)

Mailing Listx_refsource_MLISTThird Party Advisory

Source: [email protected]

http://www.openwall.com/lists/oss-security/2022/09/09/2

x_refsource_CONFIRMThird Party Advisory

Source: [email protected]

https://github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j

Mailing Listx_refsource_MLISTThird Party Advisory

Source: [email protected]

https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html

x_refsource_CONFIRMThird Party Advisory

Source: [email protected]

https://security.netapp.com/advisory/ntap-20220901-0006/

Vendor Advisoryx_refsource_DEBIANThird Party Advisory

Source: [email protected]

https://www.debian.org/security/2022/dsa-5198

CVSS

7.5HIGHeclipse

Attack Vector: NETWORK
Complexity: LOW
Privileges: NONE
User Interaction: NONE
Scope: UNCHANGED
Confidentiality: NONE
Integrity: NONE
Availability: HIGH

Vector?

Quick Info

StatusMODIFIED

CWE

CWE-410CWE-664NVD-CWE-Other

Get alerted

Stop reading CVE feeds looking for your own stack

Track the products you run and VulnTracker tells you when a new CVE affects them — with what is known about fixing it, and nothing about the rest.

Create account Sign in

Free plan, no card