Connect your agent
AdvisoriesCriticalCheck your lockfilePluginHow it worksPricing Connect your agent

Advisory record · GHSA-rggv-cv7r-mw98

Connection leaking on idle timeout when TCP congested

CVSS 7.5 HighEPSS 0.014 · 73rd percentile

Published by the GitHub Advisory Database at 26 Feb 2024, 20:13 UTC. agentprime has not analysed this yet, so whether it affects any app is not known.

PackageEcosystemAffectedFixed in
org.eclipse.jetty.http2:http2-commonMaven>=9.3.0, <9.4.54 || >=10.0.0, <10.0.20 || >=11.0.0, <11.0.209.4.54, 10.0.20, 11.0.20
org.eclipse.jetty.http3:http3-commonMaven>=10.0.8, <10.0.20 || >=11.0.8, <11.0.2010.0.20, 11.0.20
org.eclipse.jetty.http2:jetty-http2-commonMaven>=12.0.0, <12.0.612.0.6
org.eclipse.jetty.http3:jetty-http3-commonMaven>=12.0.0, <12.0.612.0.6
Identifiers
GHSA-rggv-cv7r-mw98 · CVE-2024-22201
Weakness (CWE)
CWE-400 · CWE-770
Tags
Published
26 Feb 2024
Updated
10 Sept 2026

Machine-written summary

Summary written by Claude Haiku from the source advisory. Not reviewed by a person.

Jetty's HTTP/2 and HTTP/3 common modules (http2-common, http3-common, jetty-http2-common and jetty-http3-common, across several version ranges) can leave idle connections stuck in an established state when TCP is congested, so the server does not close them. An attacker able to open HTTP/2 connections can accumulate such connections until the server runs out of file descriptors and stops accepting new clients. Upgrade to 9.4.54, 10.0.20, 11.0.20, or 12.0.6 depending on your branch. Until then, disabling HTTP/2 and HTTP/3 is the listed workaround; HTTP/1.x is not affected.

Written 2 Nov 2026.

Not analysed yet

We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.

Severity and exploitation

ScoreRatingCVSSVectorSource
7.5 High 3.1 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CNA (GitHub_M)
  • CISA KEV Not listed.
  • EPSS 0.014, the 73rd percentile, on 14 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.

Timeline

  1. 26 Feb 2024, 15:33 UTC Published by the maintainers as a GitHub repository advisory
  2. 31 Oct 2026, 14:18 UTC First seen by agentprime
  3. 31 Oct 2026, 14:18 UTC Confirmed by OSV

Sources

Facts on this page come from the GitHub Advisory Database (CC-BY 4.0), OSV and the other sources listed, as published. We don’t reproduce full advisory descriptions, which can contain exploit code.