{"id":"UBUNTU-CVE-2021-28165","details":"In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.","modified":"2025-10-24T04:50:13Z","published":"2021-04-01T15:15:00Z","upstream":["CVE-2021-28165"],"references":[{"type":"REPORT","url":"https://ubuntu.com/security/CVE-2021-28165"},{"type":"REPORT","url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-26vr-8j45-3r4w"},{"type":"REPORT","url":"https://www.cve.org/CVERecord?id=CVE-2021-28165"}],"affected":[{"package":{"name":"equinox-bundles","ecosystem":"Ubuntu:18.04:LTS","purl":"pkg:deb/ubuntu/equinox-bundles@4.9-2~18.04?arch=source&distro=bionic"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.9-2~18.04"],"ecosystem_specific":{"binaries":[{"binary_name":"libequinox-app-java","binary_version":"1.3.600+eclipse4.9-2~18.04"},{"binary_name":"libequinox-bidi-java","binary_version":"1.1.200+eclipse4.9-2~18.04"},{"binary_name":"libequinox-cm-java","binary_version":"1.3.100+eclipse4.9-2~18.04"},{"binary_version":"3.10.100+eclipse4.9-2~18.04","binary_name":"libequinox-common-java"},{"binary_name":"libequinox-concurrent-java","binary_version":"1.1.200+eclipse4.9-2~18.04"},{"binary_name":"libequinox-console-java","binary_version":"1.3.100+eclipse4.9-2~18.04"},{"binary_version":"1.3.600+eclipse4.9-2~18.04","binary_name":"libequinox-coordinator-java"},{"binary_name":"libequinox-device-java","binary_version":"1.0.700+eclipse4.9-2~18.04"},{"binary_name":"libequinox-ds-java","binary_version":"1.5.200+eclipse4.9-2~18.04"},{"binary_name":"libequinox-event-java","binary_version":"1.4.300+eclipse4.9-2~18.04"},{"binary_name":"libequinox-http-jetty-java","binary_version":"3.6.100+eclipse4.9-2~18.04"},{"binary_name":"libequinox-http-jetty-starter-java","binary_version":"1.1.100+eclipse4.9-2~18.04"},{"binary_name":"libequinox-http-registry-java","binary_version":"1.1.600+eclipse4.9-2~18.04"},{"binary_name":"libequinox-http-servlet-java","binary_version":"1.5.100+eclipse4.9-2~18.04"},{"binary_name":"libequinox-http-servletbridge-java","binary_version":"1.1.100+eclipse4.9-2~18.04"},{"binary_version":"1.1.300+eclipse4.9-2~18.04","binary_name":"libequinox-io-java"},{"binary_name":"libequinox-ip-java","binary_version":"1.1.600+eclipse4.9-2~18.04"},{"binary_name":"libequinox-jsp-jasper-java","binary_version":"1.1.100+eclipse4.9-2~18.04"},{"binary_name":"libequinox-jsp-jasper-registry-java","binary_version":"1.1.100+eclipse4.9-2~18.04"},{"binary_name":"libequinox-metatype-java","binary_version":"1.4.500+eclipse4.9-2~18.04"},{"binary_name":"libequinox-preferences-java","binary_version":"3.7.200+eclipse4.9-2~18.04"},{"binary_name":"libequinox-region-java","binary_version":"1.4.200+eclipse4.9-2~18.04"},{"binary_name":"libequinox-registry-java","binary_version":"3.8.100+eclipse4.9-2~18.04"},{"binary_name":"libequinox-security-java","binary_version":"1.2.500+eclipse4.9-2~18.04"},{"binary_name":"libequinox-servletbridge-java","binary_version":"1.4.100+eclipse4.9-2~18.04"},{"binary_name":"libequinox-transforms-hook-java","binary_version":"1.2.200+eclipse4.9-2~18.04"},{"binary_name":"libequinox-transforms-xslt-java","binary_version":"1.0.500+eclipse4.9-2~18.04"},{"binary_name":"libequinox-useradmin-java","binary_version":"1.1.600+eclipse4.9-2~18.04"},{"binary_name":"libequinox-util-java","binary_version":"1.1.100+eclipse4.9-2~18.04"},{"binary_name":"libequinox-weaving-caching-java","binary_version":"1.1.200+eclipse4.9-2~18.04"},{"binary_name":"libequinox-weaving-hook-java","binary_version":"1.2.200+eclipse4.9-2~18.04"},{"binary_name":"libequinox-wireadmin-java","binary_version":"1.0.800+eclipse4.9-2~18.04"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-28165.json"}},{"package":{"name":"equinox-bundles","ecosystem":"Ubuntu:20.04:LTS","purl":"pkg:deb/ubuntu/equinox-bundles@4.13-1?arch=source&distro=focal"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.12-1","4.13-1"],"ecosystem_specific":{"binaries":[{"binary_name":"libequinox-app-java","binary_version":"1.4.300+eclipse4.13-1"},{"binary_name":"libequinox-bidi-java","binary_version":"1.2.100+eclipse4.13-1"},{"binary_name":"libequinox-cm-java","binary_version":"1.4.100+eclipse4.13-1"},{"binary_name":"libequinox-common-java","binary_version":"3.10.500+eclipse4.13-1"},{"binary_name":"libequinox-concurrent-java","binary_version":"1.1.400+eclipse4.13-1"},{"binary_name":"libequinox-console-java","binary_version":"1.4.0+eclipse4.13-1"},{"binary_name":"libequinox-coordinator-java","binary_version":"1.3.600+eclipse4.13-1"},{"binary_name":"libequinox-device-java","binary_version":"1.0.800+eclipse4.13-1"},{"binary_name":"libequinox-ds-java","binary_version":"1.6.0+eclipse4.13-1"},{"binary_name":"libequinox-event-java","binary_version":"1.5.200+eclipse4.13-1"},{"binary_name":"libequinox-http-jetty-java","binary_version":"3.7.200+eclipse4.13-1"},{"binary_name":"libequinox-http-jetty-starter-java","binary_version":"1.1.100+eclipse4.13-1"},{"binary_name":"libequinox-http-registry-java","binary_version":"1.1.700+eclipse4.13-1"},{"binary_name":"libequinox-http-servlet-java","binary_version":"1.6.200+eclipse4.13-1"},{"binary_version":"1.1.100+eclipse4.13-1","binary_name":"libequinox-http-servletbridge-java"},{"binary_name":"libequinox-io-java","binary_version":"1.1.300+eclipse4.13-1"},{"binary_name":"libequinox-ip-java","binary_version":"1.1.600+eclipse4.13-1"},{"binary_name":"libequinox-jsp-jasper-java","binary_version":"1.1.300+eclipse4.13-1"},{"binary_name":"libequinox-jsp-jasper-registry-java","binary_version":"1.1.300+eclipse4.13-1"},{"binary_name":"libequinox-metatype-java","binary_version":"1.5.100+eclipse4.13-1"},{"binary_name":"libequinox-preferences-java","binary_version":"3.7.500+eclipse4.13-1"},{"binary_name":"libequinox-region-java","binary_version":"1.4.500+eclipse4.13-1"},{"binary_name":"libequinox-registry-java","binary_version":"3.8.500+eclipse4.13-1"},{"binary_name":"libequinox-security-java","binary_version":"1.3.300+eclipse4.13-1"},{"binary_name":"libequinox-servletbridge-java","binary_version":"1.5.100+eclipse4.13-1"},{"binary_name":"libequinox-transforms-hook-java","binary_version":"1.2.500+eclipse4.13-1"},{"binary_name":"libequinox-transforms-xslt-java","binary_version":"1.1.0+eclipse4.13-1"},{"binary_name":"libequinox-useradmin-java","binary_version":"1.1.700+eclipse4.13-1"},{"binary_name":"libequinox-util-java","binary_version":"1.1.300+eclipse4.13-1"},{"binary_name":"libequinox-weaving-caching-java","binary_version":"1.1.300+eclipse4.13-1"},{"binary_name":"libequinox-weaving-hook-java","binary_version":"1.2.400+eclipse4.13-1"},{"binary_name":"libequinox-wireadmin-java","binary_version":"1.0.800+eclipse4.13-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-28165.json"}},{"package":{"name":"equinox-bundles","ecosystem":"Ubuntu:22.04:LTS","purl":"pkg:deb/ubuntu/equinox-bundles@4.19-1?arch=source&distro=jammy"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["4.18-1","4.19-1"],"ecosystem_specific":{"binaries":[{"binary_version":"1.5.100+eclipse4.19-1","binary_name":"libequinox-app-java"},{"binary_name":"libequinox-bidi-java","binary_version":"1.3.100+eclipse4.19-1"},{"binary_name":"libequinox-cm-java","binary_version":"1.5.0+eclipse4.19-1"},{"binary_name":"libequinox-common-java","binary_version":"3.14.100+eclipse4.19-1"},{"binary_name":"libequinox-concurrent-java","binary_version":"1.2.0+eclipse4.19-1"},{"binary_version":"1.4.300+eclipse4.19-1","binary_name":"libequinox-console-java"},{"binary_name":"libequinox-coordinator-java","binary_version":"1.4.0+eclipse4.19-1"},{"binary_name":"libequinox-device-java","binary_version":"1.1.100+eclipse4.19-1"},{"binary_name":"libequinox-event-java","binary_version":"1.6.0+eclipse4.19-1"},{"binary_name":"libequinox-http-jetty-java","binary_version":"3.7.600+eclipse4.19-1"},{"binary_version":"1.1.100+eclipse4.19-1","binary_name":"libequinox-http-jetty-starter-java"},{"binary_name":"libequinox-http-registry-java","binary_version":"1.2.0+eclipse4.19-1"},{"binary_name":"libequinox-http-servlet-java","binary_version":"1.7.0+eclipse4.19-1"},{"binary_name":"libequinox-http-servletbridge-java","binary_version":"1.2.0+eclipse4.19-1"},{"binary_name":"libequinox-io-java","binary_version":"1.1.300+eclipse4.19-1"},{"binary_name":"libequinox-ip-java","binary_version":"1.1.600+eclipse4.19-1"},{"binary_name":"libequinox-jsp-jasper-java","binary_version":"1.1.500+eclipse4.19-1"},{"binary_version":"1.1.400+eclipse4.19-1","binary_name":"libequinox-jsp-jasper-registry-java"},{"binary_name":"libequinox-metatype-java","binary_version":"1.6.0+eclipse4.19-1"},{"binary_name":"libequinox-preferences-java","binary_version":"3.8.200+eclipse4.19-1"},{"binary_name":"libequinox-region-java","binary_version":"1.5.100+eclipse4.19-1"},{"binary_name":"libequinox-registry-java","binary_version":"3.10.100+eclipse4.19-1"},{"binary_name":"libequinox-security-java","binary_version":"1.3.600+eclipse4.19-1"},{"binary_name":"libequinox-security-ui-java","binary_version":"1.3.0+eclipse4.19-1"},{"binary_name":"libequinox-servletbridge-java","binary_version":"1.6.0+eclipse4.19-1"},{"binary_name":"libequinox-transforms-hook-java","binary_version":"1.3.0+eclipse4.19-1"},{"binary_version":"1.2.0+eclipse4.19-1","binary_name":"libequinox-transforms-xslt-java"},{"binary_name":"libequinox-useradmin-java","binary_version":"1.2.100+eclipse4.19-1"},{"binary_name":"libequinox-util-java","binary_version":"1.1.300+eclipse4.19-1"},{"binary_name":"libequinox-weaving-caching-java","binary_version":"1.2.0+eclipse4.19-1"},{"binary_name":"libequinox-weaving-hook-java","binary_version":"1.3.0+eclipse4.19-1"},{"binary_name":"libequinox-wireadmin-java","binary_version":"1.0.800+eclipse4.19-1"}]},"database_specific":{"source":"https://github.com/canonical/ubuntu-security-notices/blob/main/osv/cve/2021/UBUNTU-CVE-2021-28165.json"}}],"schema_version":"1.7.3","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"},{"type":"Ubuntu","score":"medium"}]}