CVE-2022-2048: Uncontrolled Resource Consumption

July 7, 2022 (updated July 19, 2022)

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

References

github.com/advisories/GHSA-wgmr-mf83-7x4j
github.com/eclipse/jetty.project/security/advisories/GHSA-wgmr-mf83-7x4j
nvd.nist.gov/vuln/detail/CVE-2022-2048

Detect and mitigate CVE-2022-2048 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Learn more about Dependency Scanning →