Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2022-2191

26
FAUCET Score

CVE-2022-2191 is a denial-of-service vulnerability affecting Eclipse Jetty versions 10.0.0 through 10.0.9 and 11.0.0 through 11.0.9. The flaw lies in the SslConnection's failure to release ByteBuffers from the ByteBufferPool during error conditions, leading to resource exhaustion. With a CVSS score of 7.5 (HIGH), this vulnerability is remotely exploitable with low attack complexity, potentially causing a complete denial of service (A:H). There is currently no evidence of active exploitation, nor are there publicly available exploit tools like Metasploit or Nuclei modules. Community discussion and media coverage for this CVE are minimal.

Impacted Technologies

VendorProductVersion(s)CPE
>= 10.0.0, <= 10.0.9CPE matchmatch criteria
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
>= 11.0.0, <= 11.0.9CPE matchmatch criteria
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
<= 10.0.9CPE match
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
<= 11.0.9CPE match
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 3.1

7.5HIGH

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
HIGH
Exploitability Score
3.9
Impact Score
3.6
CvssVersion
3.1

Exploit Intelligence

EPSS Score
2.05%
Probability of exploitation in next 30 days
EPSS Percentile
79.2%
Percentile rank of EPSS score among Peer Group
As of 2026-07-25
Model: v2026.06.15
This CVE's current EPSS score of 0.0205 is in the 63rd percentile among its peer group of 51,485 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (4)

mavenpatch availablevia ghsa
Product: org.eclipse.jetty:jetty-serverFixed in: 11.0.10
mavenpatch availablevia ghsa
Product: org.eclipse.jetty:jetty-serverFixed in: 10.0.10
redhatpatch availablevia redhat_api
Product: Red Hat AMQ Streams 2.3.0Fixed in: jetty-server
View patch
github_advisoryvendor investigatingvia nvd_reference
View patch

Vendor Advisories (2)

mavenGHSA-8mpp-f3f7-xc28high

Jetty SslConnection does not release pooled ByteBuffers in case of errors

Jul 7, 2022
redhatCVE-2022-2191Moderate

jetty-server: Improper release of ByteBuffers in SslConnections

Jul 7, 2022

References

github.com / eclipse/jetty.project/security/advisories/GHSA-8mpp-f3f7-xc28
ExploitVendor Advisory
security.netapp.com / advisory/ntap-20220909-0003
Third Party Advisory