CVE-2021-28165: Eclipse Jetty
High severity, CVSS 7.5. EPSS: 53.9% chance of exploitation in the next 30 days.
In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.
Affected products
- Eclipse Jetty: from 7.2.2, before 9.4.39 (fixed in 9.4.39); from 10.0.0, before 10.0.2 (fixed in 10.0.2); from 11.0.0, before 11.0.2 (fixed in 11.0.2)
- Jenkins Jenkins: before 2.277.3 (fixed in 2.277.3); before 2.286 (fixed in 2.286)
- Netapp Cloud Manager: before 3.9.8 (fixed in 3.9.8)
- Netapp E-Series Performance Analyzer: before 3.0 (fixed in 3.0)
- Netapp E-Series Santricity OS Controller: from 11.0.0, before 11.70.1 (fixed in 11.70.1)
- Netapp E-Series Santricity Storage: before 1.10 (fixed in 1.10)
- Netapp E-Series Santricity Web Services: before 5.1 (fixed in 5.1)
- Netapp Ontap Tools: before 9.10 (fixed in 9.10)
- Netapp Santricity Cloud Connector: affected versions not specified
- Netapp Santricity Web Services Proxy: before 5.1 (fixed in 5.1)
- Netapp Snapcenter: before 4.6 (fixed in 4.6)
- Netapp Storage Replication Adapter For Clustered Data Ontap: before 9.10 (fixed in 9.10)
- Netapp Vasa Provider For Clustered Data Ontap: before 9.10 (fixed in 9.10)
- Oracle Autovue For Agile Product Lifecycle Management: version 21.0.2 only
- Oracle Communications Cloud Native Core Policy: version 1.14.0 only
- Oracle Communications Element Manager: version 8.2.2 only
- Oracle Communications Services Gatekeeper: version 7.0 only
- Oracle Communications Session Report Manager: from 8.0.0.0, up to and including 8.2.4.0
- Oracle Communications Session Route Manager: from 8.0.0.0, up to and including 8.2.4.0
- Oracle Rest Data Services: before 21.3 (fixed in 21.3)
- Oracle Siebel Core - Automation: up to and including 21.9
Published 2021-04-01. Last modified 2026-06-17.