An unauthenticated remote attacker can trigger a denial of service condition in Eclipse Jetty by sending malformed HTTP/2 frames that force excessive resource consumption.

This is an uncontrolled resource consumption vulnerability (CWE-400) occurring within the HTTP/2 protocol implementation. An unauthenticated attacker can send specific frame sequences, such as illegal WINDOW_UPDATE frames or DATA frames for closed streams, to force the server to repeatedly generate RST_STREAM responses, leading to CPU and memory exhaustion.

The exploitation of this vulnerability directly impacts system availability, potentially causing severe service disruption or application crashes. Given the CVSS score of 7.5, which reflects high availability impact, organizations relying on Jetty for mission critical web services face significant operational risk. Continuous resource exhaustion can lead to downtime, requiring manual intervention to restore service and potentially causing cascading failures in connected infrastructure.

Immediate Action: Update to the patched versions as provided by the vendor: Jetty 9.4.58, 10.0.26, 11.0.26, 12.0.25, or 12.1.0.beta3.

Proactive Monitoring: Monitor server resource utilization, specifically CPU and memory spikes, alongside HTTP/2 traffic patterns to identify potential abuse of the stream management logic.

Compensating Controls: Deploy a Web Application Firewall (WAF) or an edge proxy configured to inspect and block malformed HTTP/2 frames or limit the rate of stream creation from individual clients.

Public Exploit Available: Unknown.

This vulnerability presents a clear risk to service availability and should be addressed as a priority. Administrators must prioritize the deployment of the provided security patches to ensure the integrity and stability of the Jetty server environment. If immediate patching is not feasible, implement strict edge filtering to limit the impact of malicious HTTP/2 traffic.