What’s Vulnerable › Vulnerabilities

CVE-2022-2047

• Severity: low (CVSS 2.7 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.3% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2022-07-07 · updated 2026-06-17
• Weakness: CWE-20

Description

In Eclipse Jetty versions 9.4.0 thru 9.4.46, and 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, the parsing of the authority segment of an http scheme URI, the Jetty HttpURI class improperly detects an invalid input as a hostname. This can lead to failures in a Proxy scenario.

Affected products

• Debian Linux: 10.0, 11.0
• The Eclipse Foundation Eclipse Jetty: before 9.4.46; from 10.0.0 before 10.0.9; from 11.0.0 through 11.0.9 — fixed in 10.0.9, 9.4.46
• NetApp, Inc. Element Plug-in for vCenter Server: all versions
• NetApp Hci Compute Node: all versions
• NetApp Management Services For Element Software And Netapp Hci: all versions
• NetApp SnapCenter: all versions
• NetApp Solidfire & Hci Storage Node: all versions

How to fix

Upgrade to a fixed version: The Eclipse Foundation Eclipse Jetty 10.0.9, 9.4.46. Check the vendor advisory for mitigations.

References

• https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
• https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html
• https://security.netapp.com/advisory/ntap-20220901-0006/
• https://www.debian.org/security/2022/dsa-5198
• https://github.com/eclipse/jetty.project/security/advisories/GHSA-cj7v-27pg-wf7q
• https://lists.debian.org/debian-lts-announce/2022/08/msg00011.html
• https://security.netapp.com/advisory/ntap-20220901-0006/
• https://www.debian.org/security/2022/dsa-5198

Get alerted when CVE-2022-2047 or the next vulnerability affects your stack