High severity7.5NVD Advisory· Published Jul 7, 2022· Updated Jun 17, 2026

CVE-2022-2191

Description

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

AI Insight

LLM-synthesized narrative grounded in this CVE's description and references.

Affected packages

Versions sourced from the GitHub Security Advisory.

Package	Affected versions	Patched versions
org.eclipse.jetty:jetty-serverMaven	>= 10.0.0, < 10.0.10	10.0.10
org.eclipse.jetty:jetty-serverMaven	>= 11.0.0, < 11.0.10	11.0.10

Affected products

ghsa-coords
pkg:maven/org.eclipse.jetty/jetty-server
Range: >= 10.0.0, < 10.0.10
Eclipse/Jetty2 versions
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*+ 1 more
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*range: >=10.0.0,<=10.0.9
- (no CPE)range: 10.0.0

Patches

Vulnerability mechanics

References

github.com/eclipse/jetty.project/security/advisories/GHSA-8mpp-f3f7-xc28nvdExploitVendor AdvisoryWEB
github.com/advisories/GHSA-8mpp-f3f7-xc28ghsaADVISORY
nvd.nist.gov/vuln/detail/CVE-2022-2191ghsaADVISORY
security.netapp.com/advisory/ntap-20220909-0003/nvdThird Party Advisory
github.com/eclipse/jetty.project/issues/8161ghsaWEB
security.netapp.com/advisory/ntap-20220909-0003ghsaWEB

News mentions

No linked articles in our index yet.

cvss	0.488
epss	0.002
exploit	0.000
kev	0.000
patch	0.000
ransomware	0.000