What’s Vulnerable › Vulnerabilities

CVE-2021-28165

• Severity: high (CVSS 7.5 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 53.9% probability of exploitation in the next 30 days
• Public exploit or detection template: yes
• Published: 2021-04-01 · updated 2026-06-17
• Weakness: CWE-400

Description

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Affected products

• The Eclipse Foundation Eclipse Jetty: from 7.2.2 before 9.4.39; from 10.0.0 before 10.0.2; from 11.0.0 before 11.0.2 — fixed in 10.0.2, 11.0.2, 9.4.39
• Jenkins: before 2.277.3; before 2.286 — fixed in 2.277.3, 2.286
• Cloud Manager: before 3.9.8 — fixed in 3.9.8
• NetApp E-Series Performance Analyzer: before 3.0 — fixed in 3.0
• E-Series SANtricity OS Controller Software 11.x: from 11.0.0 before 11.70.1 — fixed in 11.70.1
• NetApp E-Series Santricity Storage: before 1.10 — fixed in 1.10
• NetApp E-Series Santricity Web Services: before 5.1 — fixed in 5.1
• NetApp Ontap Tools: before 9.10 — fixed in 9.10
• NetApp Santricity Cloud Connector: all versions
• NetApp Santricity Web Services Proxy: before 5.1 — fixed in 5.1
• NetApp SnapCenter: before 4.6 — fixed in 4.6
• NetApp Storage Replication Adapter For Clustered Data Ontap: before 9.10 — fixed in 9.10
• NetApp Vasa Provider For Clustered Data Ontap: before 9.10 — fixed in 9.10
• Oracle Autovue For Agile Product Lifecycle Management: 21.0.2
• Oracle Communications Cloud Native Core Policy: 1.14.0
• Oracle Communications Element Manager: 8.2.2
• Oracle Communications Services Gatekeeper: 7.0
• Oracle Communications Session Report Manager: from 8.0.0.0 through 8.2.4.0
• Oracle Communications Session Route Manager: from 8.0.0.0 through 8.2.4.0
• Oracle Corporation Oracle REST Data Services: before 21.3 — fixed in 21.3
• Oracle Siebel Core - Automation: through 21.9

How to fix

Upgrade to a fixed version: The Eclipse Foundation Eclipse Jetty 10.0.2, 11.0.2, 9.4.39; Jenkins 2.277.3, 2.286; Cloud Manager 3.9.8; NetApp E-Series Performance Analyzer 3.0; E-Series SANtricity OS Controller Software 11.x 11.70.1; NetApp E-Series Santricity Storage 1.10; NetApp E-Series Santricity Web Services 5.1; NetApp Ontap Tools 9.10; NetApp Santricity Web Services Proxy 5.1; NetApp SnapCenter 4.6; NetApp Storage Replication Adapter For Clustered Data Ontap 9.10; NetApp Vasa Provider For Clustered Data Ontap 9.10. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2021/04/20/3
• https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w
• https://lists.apache.org/thread.html/r002258611ed0c35b82b839d284b43db9dcdec120db8afc1c993137dc%40%3Cnotifications.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r03ca0b69db1e3e5f72fe484b71370d537cd711cbf334e2913332730a%40%3Cissues.spark.apache.org%3E
• https://lists.apache.org/thread.html/r05db8e0ef01e1280cc7543575ae0fa1c2b4d06a8b928916ef65dd2ad%40%3Creviews.spark.apache.org%3E
• https://lists.apache.org/thread.html/r06d54a297cb8217c66e5190912a955fb870ba47da164002bf2baffe5%40%3Creviews.spark.apache.org%3E
• https://lists.apache.org/thread.html/r077b76cafb61520c14c87c4fc76419ed664002da0ddac5ad851ae7e7%40%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r0841b06b48324cfc81325de3c05a92e53f997185f9d71ff47734d961%40%3Cissues.solr.apache.org%3E
• https://lists.apache.org/thread.html/r0a241b0649beef90d422b42a26a2470d336e59e66970eafd54f9c3e2%40%3Ccommits.zookeeper.apache.org%3E
• https://lists.apache.org/thread.html/r0a4797ba6ceea8074f47574a4f3cc11493d514c1fab8203ebd212add%40%3Creviews.spark.apache.org%3E
• https://lists.apache.org/thread.html/r0bf3aa065abd23960fc8bdc8090d6bc00d5e391cf94ec4e1f4537ae3%40%3Cjira.kafka.apache.org%3E
• https://lists.apache.org/thread.html/r0cd1a5e3f4ad4770b44f8aa96572fc09d5b35bec149c0cc247579c42%40%3Creviews.spark.apache.org%3E

Get alerted when CVE-2021-28165 or the next vulnerability affects your stack