In Eclipse Jetty versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, and <=12.1.0.alpha2, an HTTP/2 client can exploit the server by sending malformed frames, causing it to send RST_STREAM frames. This can lead to excessive resource consumption, such as CPU and memory, as the client can create numerous streams quickly without exceeding the maximum concurrent streams limit.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 7.5 | CVE-2025-5115 |
Exploitation
To exploit this vulnerability, an attacker can craft an HTTP/2 client that sends malformed WINDOW_UPDATE frames to the server. By doing so, the attacker can force the server to respond with RST_STREAM frames, leading to resource exhaustion as the server processes these invalid requests.
Affected Products
- Eclipse Jetty 9.4.57 and earlier: Affected by malformed frame handling.
- Eclipse Jetty 10.0.25 and earlier: Vulnerable to resource exhaustion through HTTP/2 streams.
- Eclipse Jetty 11.0.25 and earlier: Susceptible to attacks exploiting malformed WINDOW_UPDATE frames.
- Eclipse Jetty 12.0.21 and earlier: Can be exploited by sending illegal frames.
- Eclipse Jetty 12.1.0.alpha2 and earlier: Vulnerable to excessive resource consumption.
Mitigation
To mitigate this vulnerability, users should upgrade to the latest versions of Eclipse Jetty that address this issue. Regularly applying security patches and monitoring for updates can help protect against potential exploitation.