> CVE-2025-5115

« BACK_TO_HOME
PUBLISHED
2025-08-20 20:15
MODIFIED
2025-08-22 18:09
EPSS (Prob. Exploit)
3.57%
Top 10.7%
DATA SOURCES:
NVD 🔗 2025-10-18 RED HAT 🔗 2025-10-18 CVE PROJECT 🔗 2026-01-19 FIRST EPSS 🔗 2026-10-25 GITHUB 🔗 2026-11-04 OSV 🔗 2026-09-20

> DESCRIPTION

In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_STREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume resources such as CPU and memory. For example, a client can open a stream and then send WINDOW_UPDATE frames with window size increment of 0, which is illegal. Per specification https://www.rfc-editor.org/rfc/rfc9113.html#name-window_update , the server should send a RST_STREAM frame. The client can now open another stream and send another bad WINDOW_UPDATE, therefore causing the server to consume more resources than necessary, as this case does not exceed the max number of concurrent streams, yet the client is able to create an enormous amount of streams in a short period of time. The attack can be performed with other conditions (for example, a DATA frame for a closed stream) that cause the server to send a RST_STREAM frame. Links: * https://github.com/jetty/jetty.project/security/advisories/GHSA-mmxm-8w33-wc4h

> AFFECTED_PRODUCTS

Red Hat - Red Hat AMQ Broker 7.13.2
Red Hat - OCP-Tools-4.12-RHEL-8
Version: 2.516.3.1758299374
Red Hat - OCP-Tools-4.12-RHEL-8
Version: 2
Red Hat - OCP-Tools-4.13-RHEL-8
Version: 2.516.3.1758298953
Red Hat - OCP-Tools-4.13-RHEL-8
Version: 2
Red Hat - OCP-Tools-4.14-RHEL-8
Version: 2.516.3.1758302106
Red Hat - OCP-Tools-4.14-RHEL-8
Version: 2
Red Hat - OCP-Tools-4.15-RHEL-8
Version: 2.516.3.1758302665
Red Hat - OCP-Tools-4.15-RHEL-8
Version: 2
Red Hat - OCP-Tools-4.16-RHEL-9
Version: 2.516.3.1758336945
Red Hat - OCP-Tools-4.16-RHEL-9
Version: 2
Red Hat - OCP-Tools-4.17-RHEL-9
Version: 2.516.3.1758259817
Red Hat - OCP-Tools-4.17-RHEL-9
Version: 2
Red Hat - OCP-Tools-4.18-RHEL-9
Version: 2.516.3.1758260563
Red Hat - OCP-Tools-4.18-RHEL-9
Version: 2
Red Hat - OCP-Tools-4.19-RHEL-9
Version: 2.516.3.1758206866
Red Hat - OCP-Tools-4.19-RHEL-9
Version: 2
Red Hat - Red Hat build of Apache Camel 4.10.6 for Spring Boot 3.4.9
Red Hat - Red Hat Offline Knowledge Portal 1.1.2

> RED HAT SECURITY ADVISORIES

Red Hat Security Advisory: Red Hat AMQ Broker 7.13.2 release and security update
Red Hat AMQ Broker 7.13.2 is now available from the Red Hat Customer Portal. Red Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring Sy...
Red Hat Security Advisory: Red Hat Offline Knowledge Portal update
Red Hat Offline Knowledge Portal update
Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update
An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.14. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Sco...
Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update
An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.15. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Sco...
Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.13. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Sco...
Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update
An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.12. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Sco...
Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update
An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.16. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Sco...
Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update
An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.17. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Sco...
Red Hat Security Advisory: Red Hat Product OCP Tools 4.19 OpenShift Jenkins security update
An update for OpenShift Jenkins is now available for Red Hat Product OCP Tools 4.19. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Sco...
Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 Openshift Jenkins security update
An update for Openshift Jenkins is now available for Red Hat Product OCP Tools 4.18. Red Hat Product Security has rated this update as having a security impact of important. A Common Vulnerability Sco...
Red Hat Security Advisory: Red Hat Build of Apache Camel 4.10.6 for Spring Boot release.
Red Hat build of Apache Camel 4.10.6 for Spring Boot patch release and security update is now available. Red Hat Product Security has rated this update as having a security impact of Important. A Com...

> RED HAT SEVERITY ASSESSMENT

THREAT SEVERITY
Important

> GITHUB SECURITY ADVISORY

GHSA-mmxm-8w33-wc4h HIGH

Eclipse Jetty affected by MadeYouReset HTTP/2 vulnerability

AFFECTED PACKAGES:
MAVEN / org.eclipse.jetty.http2:jetty-http2-common
>= 12.1.0.alpha0, <= 12.1.0.beta2
Fixed in: 12.1.0.beta3
MAVEN / org.eclipse.jetty.http2:jetty-http2-common
>= 12.0.0, <= 12.0.24
Fixed in: 12.0.25
MAVEN / org.eclipse.jetty.http2:http2-common
>= 11.0.0, <= 11.0.25
Fixed in: 11.0.26
MAVEN / org.eclipse.jetty.http2:http2-common
>= 10.0.0, <= 10.0.25
Fixed in: 10.0.26
MAVEN / org.eclipse.jetty.http2:http2-common
>= 9.3.0, <= 9.4.57
Fixed in: 9.4.58

> OSV (GOOGLE OPEN SOURCE VULNERABILITIES)

MadeYouReset HTTP/2 vulnerability

AFFECTED PACKAGES:
Unknown / Unknown
13 versions affected
ALIASES:
GHSA-mmxm-8w33-wc4h

> HISTORIQUE DES MODIFICATIONS

Première apparition
20/08/2025 20:15
Source: NVD
📊 ENRICHISSEMENT 18/10/2025 15:07
CVEPROJECT
Champ modifié: CVE Project
Ancienne valeur:
Non
Nouvelle valeur:
Oui
📊 ENRICHISSEMENT 18/10/2025 12:08
REDHAT
Champ modifié: Sévérité Red Hat
Ancienne valeur:
N/A
Nouvelle valeur:
{ "threat_severity": "Important", "severity_scale": null }
📊 ENRICHISSEMENT 18/10/2025 12:08
REDHAT
Champ modifié: Red Hat
Ancienne valeur:
Non
Nouvelle valeur:
Oui
Total des modifications: 3 Dernière mise à jour: 1 year ago
« BACK_TO_HOME