VYPR
← All advisories
High severityNVD Advisory· Published Apr 1, 2021· Updated Aug 27, 2025

CVE-2021-28165

CVE-2021-28165

Description

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Eclipse Jetty versions before 9.4.39, 10.0.2, 11.0.2 can be DoSed to 100% CPU by a large invalid TLS frame.

Vulnerability

In Eclipse Jetty, when using SSL/TLS with HTTP/1.1, HTTP/2, or WebSocket, the server fails to properly handle a large invalid TLS frame (greater than 17408 bytes). This results in a CPU usage spike to 100%. Affected versions include Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1 [1][2].

Exploitation

An attacker with network access to a Jetty server listening on an SSL/TLS port can send a crafted large TLS frame. No authentication or user interaction is required. Upon receipt, the server enters a processing loop that consumes all CPU resources [2].

Impact

Successful exploitation causes a denial of service (DoS) by exhausting CPU resources, rendering the Jetty server unresponsive. Only availability is affected; no data confidentiality or integrity is compromised [2].

Mitigation

The issue is fixed in Jetty versions 9.4.39, 10.0.2, and 11.0.2 [2]. A workaround is to replace the SslConnectionFactory with a custom implementation that checks the TLS frame size, as detailed in the GitHub advisory [2]. For Jenkins users, updating to Jenkins 2.286 or LTS 2.277.3 resolves the bundled Jetty vulnerability [3].

References
  1. NVD - CVE-2021-28165
  2. CPU 100% receiving an invalid large TLS frame
  3. security - Vulnerability in Jenkins

AI Insight generated on May 21, 2026. Synthesized from this CVE's description and the cited reference URLs; citations are validated against the source bundle.

Affected packages

Versions sourced from the GitHub Security Advisory.

PackageAffected versionsPatched versions
org.eclipse.jetty:jetty-serverMaven
>= 7.2.2, < 9.4.399.4.39
org.eclipse.jetty:jetty-serverMaven
>= 10.0.0, < 10.0.210.0.2
org.eclipse.jetty:jetty-serverMaven
>= 11.0.0, < 11.0.211.0.2

Affected products

5

Patches

0

No patches discovered yet.

Vulnerability mechanics

AI mechanics synthesis has not run for this CVE yet.

References

209

News mentions

1