CVE-2025-5115

29

FAUCET Score

CVE-2025-5115 describes a denial-of-service vulnerability in Eclipse Jetty versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, and <=12.1.0.alpha2. An unauthenticated HTTP/2 client can send malformed frames, such as illegal WINDOW_UPDATE frames, forcing the server to repeatedly send RST_STREAM frames and consume excessive CPU and memory resources. This vulnerability is rated as High severity (CVSS 7.5) due to its network-based attack vector, low attack complexity, and high impact on availability. Currently, there is no public exploit code available, it is not listed in CISA's KEV catalog, and community discussion and media coverage are minimal, suggesting it is not actively exploited.

Impacted Technologies

Vendor	Product	Version(s)	CPE
		>= 9.3.0, <= 9.4.57CPE matchmatch criteria	cpe:2.3:a:eclipse:jetty::::::::
		>= 10.0.0, <= 10.0.25CPE matchmatch criteria	cpe:2.3:a:eclipse:jetty::::::::
		>= 11.0.0, <= 11.0.25CPE matchmatch criteria	cpe:2.3:a:eclipse:jetty::::::::
		>= 12.0.0, <= 12.0.21CPE matchmatch criteria	cpe:2.3:a:eclipse:jetty::::::::
		12.1.0CPE matchmatch criteria	cpe:2.3:a:eclipse:jetty:12.1.0:alpha0::::::

CVSS Data

CVSS version used by this source: 4.0

7.7HIGH

CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:N/SC:N/SI:N/SA:H/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X

Attack Vector

NETWORK

Attack Complexity

LOW

Attack Requirements

NONE

Privileges Required

NONE

User Interaction

NONE

VS Confidentiality

NONE

VS Integrity

NONE

VS Availability

NONE

SS Confidentiality

NONE

SS Integrity

NONE

SS Availability

HIGH

Exploit Maturity

NOT_DEFINED

CvssVersion

4.0

Exploit Intelligence

EPSS Score

1.63%

Probability of exploitation in next 30 days

EPSS Percentile

73.7%

Percentile rank of EPSS score among Peer Group

As of 2026-07-27

Model: v2026.06.15

This CVE's current EPSS score of 0.0163 is in the 56th percentile among its peer group of 51,553 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.1 Bluesky, 0.1 Mastodon, and 0.4 GitHub mentions.

Media Mentions

The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (35)

mavenpatch availablevia ghsa

Product: org.eclipse.jetty.http2:jetty-http2-commonFixed in: 12.0.25

mavenpatch availablevia ghsa

Product: org.eclipse.jetty.http2:jetty-http2-commonFixed in: 12.1.0.beta3

mavenpatch availablevia ghsa

Product: org.eclipse.jetty.http2:http2-commonFixed in: 9.4.58

mavenpatch availablevia ghsa

Product: org.eclipse.jetty.http2:http2-commonFixed in: 10.0.26

mavenpatch availablevia ghsa

Product: org.eclipse.jetty.http2:http2-commonFixed in: 11.0.26

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.14-RHEL-8Fixed in: jenkins-0:2.516.3.1758302106-3.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.14-RHEL-8Fixed in: jenkins-2-plugins-0:4.14.1758302383-1.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.15-RHEL-8Fixed in: jenkins-0:2.516.3.1758302665-3.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.15-RHEL-8Fixed in: jenkins-2-plugins-0:4.15.1758303157-1.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.16-RHEL-9Fixed in: jenkins-0:2.516.3.1758336945-3.el9

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.16-RHEL-9Fixed in: jenkins-2-plugins-0:4.16.1758337173-1.el9

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.17-RHEL-9Fixed in: jenkins-0:2.516.3.1758259817-3.el9

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.17-RHEL-9Fixed in: jenkins-2-plugins-0:4.17.1758260106-1.el9

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.18-RHEL-9Fixed in: jenkins-2-plugins-0:4.18.1758260849-1.el9

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.19-RHEL-9Fixed in: jenkins-0:2.516.3.1758206866-3.el9

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.19-RHEL-9Fixed in: jenkins-2-plugins-0:4.19.1758207171-1.el9

redhatpatch availablevia redhat_api

Product: Red Hat AMQ Broker 7.13.2Fixed in: jetty-http2-common

redhatpatch availablevia redhat_api

Product: Red Hat AMQ Broker 7.13.2Fixed in: jetty-http2-hpack

redhatpatch availablevia redhat_api

Product: Red Hat AMQ Broker 7.13.2Fixed in: jetty-http2-server

redhatpatch availablevia redhat_api

Product: Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9Fixed in: jetty-http2-client

redhatpatch availablevia redhat_api

Product: Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9Fixed in: jetty-http2-client-transport

redhatpatch availablevia redhat_api

Product: Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9Fixed in: jetty-http2-common

redhatpatch availablevia redhat_api

Product: Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9Fixed in: jetty-http2-hpack

redhatpatch availablevia redhat_api

Product: Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9Fixed in: jetty-http2-server

redhatpatch availablevia redhat_api

Product: Red Hat Offline Knowledge Image 1.1.5Fixed in: offline-knowledge-portal/rhokp-rhel9:sha256:7d3aed2d9f40ed84bf0b9fb71d336780a3668c0f9d29cc29ee7e11bccf7ef7bd

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.18-RHEL-9Fixed in: jenkins-0:2.516.3.1758260563-3.el9

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.12-RHEL-8Fixed in: jenkins-0:2.516.3.1758299374-3.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.12-RHEL-8Fixed in: jenkins-2-plugins-0:4.12.1758299735-1.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.13-RHEL-8Fixed in: jenkins-0:2.516.3.1758298953-3.el8

redhatpatch availablevia redhat_api

Product: OCP-Tools-4.13-RHEL-8Fixed in: jenkins-2-plugins-0:4.13.1758299004-1.el8

redhatno patchvia redhat_api

Product: Red Hat JBoss Enterprise Application Platform 7Fixed in: netty-codec-http2

redhatend of lifevia redhat_api

Product: Red Hat AMQ Broker 7Fixed in: netty-codec-http2

redhatend of lifevia redhat_api

Product: Red Hat build of Debezium 2Fixed in: netty-codec-http2

redhatend of lifevia redhat_api

Product: Red Hat build of Debezium 3Fixed in: netty-codec-http2

redhatend of lifevia redhat_api

Product: Red Hat build of OptaPlanner 8Fixed in: netty-codec-http2

Vendor Advisories (2)

mavenGHSA-mmxm-8w33-wc4hhigh

Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability

redhatCVE-2025-5115Important

jetty: HTTP/2 (including DNS over HTTPS) contains a design flaw and is vulnerable to "MadeYouReset" DoS attack through HTTP/2 control frames

References

lists.debian.org / debian-lts-announce/2025/09/msg00014.html

Issue TrackingMailing List

kb.cert.org / vuls/id/767506

Third Party Advisory

openwall.com / lists/oss-security/2025/08/20/4

Third Party Advisory

openwall.com / lists/oss-security/2025/09/17/1

Third Party Advisory

github.com / jetty/jetty.project/pull/13449

Issue Tracking

github.com / jetty/jetty.project/releases/tag/jetty-10.0.26

Release Notes

github.com / jetty/jetty.project/releases/tag/jetty-11.0.26

Release Notes

github.com / jetty/jetty.project/releases/tag/jetty-12.0.25

Release Notes

github.com / jetty/jetty.project/releases/tag/jetty-12.1.0

Release Notes

github.com / jetty/jetty.project/releases/tag/jetty-9.4.58.v20250814

Release Notes

github.com / jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h

Third Party Advisory