CVE-2024-22201

What it actually does

An HTTP/2 SSL connection that is established and TCP congested is leaked when it times out, causing exhaustion of file descriptors.

Why it matters to the business

The server may run out of file descriptors and stop accepting new connections from valid clients, leading to denial of service. The issue affects a widely used Java web server component with many downstream dependents.

How an attack unfolds

An attacker causes many HTTP/2 SSL connections to become TCP congested. When the connections time out they are leaked instead of being released, accumulating until the server exhausts file descriptors and becomes unavailable.

How to fix it

Upgrade eclipse/jetty.project to version 9.4.54, 10.0.20, 11.0.20, 12.0.6 or later (fixed in commit 78ab6e6ba163f89cdd97f2ae0283fbb5e371cfaf).

How to confirm the fix worked

Confirm the running Jetty version matches or exceeds a fixed release and test under sustained connection load to verify file descriptors are released on timeout.

Typical attack path

1. Establish multiple HTTP/2 SSL connections to the target server
2. Induce TCP congestion on the connections
3. Allow the connections to time out while keeping them in the leaked state
4. Repeat the process until file descriptors are exhausted

How to detect it

Review server logs for large numbers of timed-out HTTP/2 SSL connections that remain open and correlate with rising file descriptor usage.

What your security team should do

• Apply the listed fixed versions immediately due to the public disclosure and potential for resource exhaustion
• Monitor file descriptor and connection counts in production environments
• Consider connection rate limiting or timeouts as temporary mitigations