CVE-2022-2048

Root

Cause

CVE-2022-2048 is a vulnerability in the Eclipse Jetty HTTP/2 server implementation. When the server encounters an invalid HTTP/2 request, the error handling routine does not properly release active connections and associated resources, leading to a resource leak [1][4].

Exploitation

An unauthenticated attacker can exploit this by sending specially crafted invalid HTTP/2 requests. The server attempts to write a blocking error response directly from the selector thread. If the attacker manages to exhaust the HTTP/2 flow control window or cause TCP congestion, the selector thread becomes blocked. Repeated exploitation can exhaust all selector threads, rendering the server unresponsive [4].

Impact

Successful exploitation results in a denial of service (DoS) condition, where the server cannot process legitimate requests due to insufficient resources [1][4].

Mitigation

The issue is fixed in Jetty versions 9.4.47, 10.0.10, and 11.0.10 [4]. Users of Jenkins, which bundles Winstone-Jetty, are also affected and should update to Jenkins 2.263 or Jenkins LTS 2.361.1 [2]. No workaround is available within Jetty itself, but filtering invalid requests upstream (e.g., via a proxy) can provide temporary relief [4].