CVE-2021-28165

7.5 highEPSS 54%

High (7.5). EPSS 54% chance of exploitation in the next 30 days. Fixed in org.eclipse.jetty:jetty-server 10.0.2, 11.0.2, 9.4.39.

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Severity

CVSS 3.1

7.5 high

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

EPSS: 54% chance of exploitation in the next 30 days; higher than 99% of CVEs (scores of 2026-10-31)
CWEs: CWE-400, CWE-551, CWE-755
Published: 2021-04-01
Modified: 2026-06-17
Record from: the NVD, synced 2026-10-19

Affected

eclipse:jetty
jenkins:jenkins
netapp:cloud_manager
netapp:e-series_performance_analyzer
netapp:e-series_santricity_os_controller
netapp:e-series_santricity_storage
netapp:e-series_santricity_web_services
netapp:ontap_tools
netapp:santricity_cloud_connector
netapp:santricity_web_services_proxy
netapp:snapcenter
netapp:storage_replication_adapter_for_clustered_data_ontap
netapp:vasa_provider_for_clustered_data_ontap
oracle:autovue_for_agile_product_lifecycle_management
oracle:communications_cloud_native_core_policy
oracle:communications_element_manager
oracle:communications_services_gatekeeper
oracle:communications_session_report_manager
oracle:communications_session_route_manager
oracle:rest_data_services
oracle:siebel_core_-_automation

Packages (OSV)

Advisory	Ecosystem	Package	Affected	Fixed in
GHSA-26vr-8j45-3r4w	Maven	org.eclipse.jetty:jetty-server	>=7.2.2 <9.4.39	9.4.39
GHSA-26vr-8j45-3r4w	Maven	org.eclipse.jetty:jetty-server	>=10.0.0 <10.0.2	10.0.2
GHSA-26vr-8j45-3r4w	Maven	org.eclipse.jetty:jetty-server	>=11.0.0 <11.0.2	11.0.2

References

Check your stack JSON