CVE-2022-2048 Jetty vulnerable to Invalid HTTP/2 requests that can lead to denial of service

What is CVE-2022-2048?

CVE-2022-2048 is a high-severity denial of service vulnerability in Debian Debian Linux, published on 7 Jul 2022. An attacker can exploit it over the internet without logging in, with no action from the victim.

Official description

In Eclipse Jetty HTTP/2 server implementation, when encountering an invalid HTTP/2 request, the error handling has a bug that can wind up not properly cleaning up the active connections and associated resources. This can lead to a Denial of Service scenario where there are no enough resources left to process good requests.

Weakness: CWE-664, CWE-410

Which versions are affected by CVE-2022-2048?

7 open source packages ship an affected version, including org.eclipse.jetty.http2:http2-server and jenkins. It affects 8 products.

Products include Debian Debian Linux, Eclipse Jetty, Jenkins Jenkins, Netapp Element Plug-in for Vcenter Server, Netapp Hci Compute Node, Netapp Management Services for Element Software and Netapp Hci and 2 more.

How do I fix CVE-2022-2048?

Upgrade org.eclipse.jetty.http2:http2-server to a fixed version for your release line: 9.4.47, 10.0.10 or 11.0.10.

Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.

Is CVE-2022-2048 being exploited?

There is no known exploitation of CVE-2022-2048 in the wild and no public exploit code.

Other vulnerabilities in Debian Debian Linux

• CVE-2015-3306 ProFTPD Improper Access Control Exploited Critical 10.0
• CVE-2025-49113 RoundCube Webmail Deserialization of Untrusted Data Exploited Critical 9.9
• CVE-2026-24061 GNU InetUtils Argument Injection Exploited Critical 9.8
• CVE-2025-39682 Linux Kernel Improper Check for Unusual or Exceptional Conditions Exploited Critical 9.8
• CVE-2024-9680 Mozilla Firefox Use-After-Free Exploited Critical 9.8

All Debian Debian Linux vulnerabilities

Sources

• CVE record
• NVD
• OSV
• GitHub advisory
• How this page is made

Also known as BIT-jenkins-2022-2048, DEBIAN-CVE-2022-2048, GHSA-wgmr-mf83-7x4j, UBUNTU-CVE-2022-2048.