CVE-2022-2191

State: Published
Severity: 7.5 High
Published: Jul 7, 2022
Updated: Aug 3, 2024
Reserved: Jun 23, 2022

Description

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

Scores

CVSS	Score	Vector	Source
3.1	7.5 High	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	eclipse

Weaknesses

CWE-404
CWE-664

Affected Products

Product	Versions
Eclipse JettyThe Eclipse Foundation	10.0.0 to before unspecifiedAffected 10.0.9 and earlierAffected 11.0.0 to before unspecifiedAffected 11.0.9 and earlierAffected

References

https://github.com/eclipse/jetty.project/security/advisories/GHSA-8mpp-f3f7-xc28
https://security.netapp.com/advisory/ntap-20220909-0003/

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.