https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-03T22:28:43.989476+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/bdu:2023-05665 bdu:2023-05665 2026-10-03T22:28:44.105542+00:00 bdu:2023-05665 https://cve.radiocsirt.org/vuln/certfr-2023-avi-0357 certfr-2023-avi-0357 — De multiples vulnérabilités ont été découvertes dans IBM Cognos. Certaines d'entre elles permettent à un attaquant de p… 2026-10-03T22:28:44.105580+00:00 certfr-2023-avi-0357 https://cve.radiocsirt.org/vuln/euvd-2026-12231 EUVD-2026-12231 2026-10-03T22:28:44.105601+00:00 EUVD-2026-12231 https://cve.radiocsirt.org/vuln/fkie_cve-2022-2191 fkie_cve-2022-2191 2026-10-03T22:28:44.105614+00:00

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

 https://cve.radiocsirt.org/vuln/ghsa-8mpp-f3f7-xc28 GHSA-8mpp-f3f7-xc28 — Jetty SslConnection does not release pooled ByteBuffers in case of errors 2026-10-03T22:28:44.105642+00:00

Affected: Maven: org.eclipse.jetty:jetty-server

### Impact `SslConnection` does not release `ByteBuffer`s in case of error code paths. For example, TLS handshakes that require client-auth with clients that send expired certificates will trigger a TLS handshake errors and the `ByteBuffer`s used to process the TLS handshake will be leaked.

### Workarounds Configure explicitly a `RetainableByteBufferPool` with `max[Heap|Direct]Memory` to limit the amount of memory that is leaked. Eventually the pool will be full of "active" entries (the leaked ones) and will provide `ByteBuffer`s that will be GCed normally.

_With embedded-jetty_

``` java int maxBucketSize = 1000; long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB long maxDirectMemory = 128 * 1024L * 1024L; // 128 MB RetainableByteBufferPool rbbp = new ArrayRetainableByteBufferPool(0, -1, -1, maxBucketSize, maxHeapMemory, maxDirectMemory);

server.addBean(rbbp); // make sure the ArrayRetainableByteBufferPool is added before the server is started server.start(); ```

_With jetty-home/jetty-base_

Create a `${jetty.base}/etc/retainable-byte-buffer-config.xml`

``` xml <?xml version="1.0"?> <!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">

<Configure id="Server" class="org.eclipse.jetty.server.Server"> <Call name="addBean"> <Arg> <New class="org.eclipse.jetty.io.ArrayRetainableByteBufferPool"> <Arg type="int"><Property name="jetty.byteBufferPool.minCapacity" default="0"/></Arg> <Arg type="int…

 https://cve.radiocsirt.org/vuln/gsd-2022-2191 gsd-2022-2191 2026-10-03T22:28:44.105695+00:00 gsd-2022-2191 https://cve.radiocsirt.org/vuln/rhsa-2023:0189 RHSA-2023:0189 — Red Hat Security Advisory: Red Hat AMQ Streams 2.3.0 release and security update 2026-10-03T22:28:44.105708+00:00

jetty-http: improver hostname input handling http2-server: Invalid HTTP/2 requests cause DoS jetty-server: Improper release of ByteBuffers in SslConnections snakeyaml: Uncaught exception in java.base/java.util.ArrayList.hashCode jackson-databind: deep wrapper array nesting wrt UNWRAP_SINGLE_VALUE_ARRAYS jackson-databind: use of deeply nested arrays

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2022-2191 UBUNTU-CVE-2022-2191 2026-10-03T22:28:44.105736+00:00

Affected: Ubuntu:14.04:LTS: jetty, Ubuntu:14.04:LTS: jetty8, Ubuntu:16.04:LTS: jetty, Ubuntu:16.04:LTS: jetty8

In Eclipse Jetty versions 10.0.0 thru 10.0.9, and 11.0.0 thru 11.0.9 versions, SslConnection does not release ByteBuffers from configured ByteBufferPool in case of error code paths.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2022-0614 WID-SEC-W-2022-0614 — Eclipse Jetty: Mehrere Schwachstellen 2026-10-03T22:28:44.105760+00:00

Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um einen Denial of Service Angriff durchzuführen und Informationen zu manipulieren.