CVE-2025-5115
📋 TL;DR
This vulnerability in Eclipse Jetty allows HTTP/2 clients to trigger resource exhaustion attacks by sending malformed frames that force the server to send RST_STREAM responses. Attackers can rapidly create streams with illegal WINDOW_UPDATE frames or other invalid frames, consuming server CPU and memory resources. All organizations running affected Jetty versions with HTTP/2 enabled are vulnerable.
💻 Affected Systems
- Eclipse Jetty
📦 What is this software?
Jetty by Eclipse
Jetty by Eclipse
Jetty by Eclipse
Jetty by Eclipse
Jetty by Eclipse
Jetty by Eclipse
Jetty by Eclipse
⚠️ Risk & Real-World Impact
Worst Case
Complete denial of service through resource exhaustion, making the Jetty server unavailable to legitimate users due to CPU/memory depletion.
Likely Case
Degraded server performance and intermittent service disruptions under sustained attack, potentially affecting application availability.
If Mitigated
Minimal impact with proper rate limiting, monitoring, and updated versions, though some resource consumption may still occur.
🎯 Exploit Status
Attack requires HTTP/2 client capability but no authentication. Simple to implement based on published details.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Jetty 9.4.58, 10.0.26, 11.0.26, 12.0.25, 12.1.0
Vendor Advisory: https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h
Restart Required: Yes
Instructions:
1. Identify current Jetty version. 2. Download patched version from official Jetty releases. 3. Replace vulnerable Jetty installation with patched version. 4. Restart Jetty server and dependent applications.
🔧 Temporary Workarounds
Disable HTTP/2
allTemporarily disable HTTP/2 protocol support to prevent exploitation while patching.
Configure Jetty connector to use HTTP/1.1 only. Remove HTTP/2 configuration from jetty.xml or server configuration.
Rate Limit HTTP/2 Connections
allImplement connection rate limiting at network or application level to reduce attack impact.
Use firewall rules or load balancer to limit new HTTP/2 connections per source IP.
🧯 If You Can't Patch
- Implement strict network segmentation to isolate Jetty servers from untrusted networks.
- Deploy Web Application Firewall (WAF) with HTTP/2 anomaly detection rules.
🔍 How to Verify
Check if Vulnerable:
Check Jetty version and verify if HTTP/2 is enabled in configuration files.Check Version:
java -jar start.jar --version or check server startup logs for version information.Verify Fix Applied:
Confirm Jetty version is updated to patched version and test HTTP/2 functionality remains operational.📡 Detection & Monitoring
Log Indicators:
- High frequency of RST_STREAM frames in logs
- Unusual number of HTTP/2 stream creations
- Increased CPU/memory usage patterns
Network Indicators:
- Multiple HTTP/2 connections with WINDOW_UPDATE frames of size 0
- Rapid stream creation and reset patterns
SIEM Query:
source="jetty.logs" AND ("RST_STREAM" OR "WINDOW_UPDATE") | stats count by src_ip🔗 References
- https://github.com/jetty/jetty.project/pull/13449
- https://github.com/jetty/jetty.project/releases/tag/jetty-10.0.26
- https://github.com/jetty/jetty.project/releases/tag/jetty-11.0.26
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.25
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.0
- https://github.com/jetty/jetty.project/releases/tag/jetty-9.4.58.v20250814
- https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h
- http://www.openwall.com/lists/oss-security/2025/08/20/4
- http://www.openwall.com/lists/oss-security/2025/09/17/1
- https://lists.debian.org/debian-lts-announce/2025/09/msg00014.html
- https://www.kb.cert.org/vuls/id/767506
