VDB
RHSA-2021:2689
RHSA-2021:2689
PUBLISHED
CVSS 5.300000190734863 MEDIUM
In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 (inclusive), 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” (i.e. q) parameters, the server may enter a denial of service (DoS) state due to high CPU usage processing those quality values, resulting in minutes of CPU time exhausted processing those quality values.
Risk Scores
CVSS 3.1
5.300000190734863
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Red Hat | Red Hat AMQ 7.8.2 |
Timeline
- Jul 12, 2021 CVE Published
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 1, 2026 Security Advisory
- May 14, 2026 CVE Updated
- May 15, 2026 Distribution Patch
- May 15, 2026 Distribution Patch
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
- May 15, 2026 Security Advisory
References
- https://access.redhat.com/security/updates/classification/#moderate advisory
- https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?downloadType=distributions&product=jboss.amq.broker&version=7.8.2 advisory
- https://access.redhat.com/documentation/en-us/red_hat_amq/2020.q4/ advisory
- https://bugzilla.redhat.com/show_bug.cgi?id=1927028 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1937364 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1944888 issue
- https://bugzilla.redhat.com/show_bug.cgi?id=1945710 issue
- https://www.cve.org/CVERecord?id=CVE-2020-27223 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2020-27223 advisory
- https://github.com/eclipse/jetty.project/security/advisories/GHSA-m394-8rww-3jr7 advisory
- https://access.redhat.com/security/cve/CVE-2021-3425 advisory
- https://access.redhat.com/security/cve/CVE-2021-21290 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-21290 advisory
- https://access.redhat.com/security/cve/CVE-2021-21295 advisory
- https://nvd.nist.gov/vuln/detail/CVE-2021-21295 advisory
- https://github.com/netty/netty/security/advisories/GHSA-wm47-8v5p-wjpj advisory
- https://access.redhat.com/security/cve/CVE-2021-21409 advisory
- https://www.cve.org/CVERecord?id=CVE-2021-21409 advisory
- https://github.com/netty/netty/security/advisories/GHSA-f256-j965-7f32 advisory
- https://access.redhat.com/security/cve/CVE-2021-28163 advisory
…and 23 more