ZDF
Sign inSign up

Vulnerabilities

Threat intelligence · CVE-2021-28165

In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Published Apr 1, 2021 · catalog updated Jun 17, 2026 · In Eclipse Jetty 7.2.2

Last checked Nov 8, 2026. A connected source was read within the last 7 days.

Check this week

CVE-2021-28165 is not in CISA KEV. FIRST estimates a 53.86% chance of exploitation in the next 30 days. Check whether you run In Eclipse Jetty 7.2.2.

Gaps on this record

  • The stored product name is a package slug. The name on this page is taken from the title (In Eclipse Jetty 7.2.2).
  • No vendor fix or required action is stored. Compare the linked advisory before you change production.

Same product and reporting

Severity
High7.5
Known exploitation
Not in CISA/VulnCheck KEV
EPSS
53.86%
Remediation
Version ranges on file
Affected products
cpe eclipse/jetty · cpe oracle/autovue for agile product lifecycle management · cpe oracle/communications cloud native core policy · cpe oracle/communications element manager

K15338344: vulnerabilidad del embarcadero de Eclipse CVE-2021-28165 En Eclipse Jetty 7.2.2 a 9.4.38, 10.0.0.alpha0 a 10.0.1 y 11.0.0.alpha0 a 11.0.1, el uso de CPU puede alcanzar el 100% al recibir una gran trama TLS no válida. ( CVE-2021-28165 ) Impacto Los sistemas afectados pueden experimentar agotamiento de recursos cuando reciben una trama TLS grande no válida.

Are you affected?

Enter the version you run. The result uses only the ranges stored on this record.

The check returns affected, not affected, or incomplete. It does not guess a version that is missing from the record.

  • cpe eclipse/jetty< 10.0.2
  • cpe eclipse/jetty< 11.0.2
  • cpe eclipse/jetty< 9.4.39
  • cpe oracle/autovue for agile product lifecycle management21.0.2
  • cpe oracle/communications cloud native core policy1.14.0
  • cpe oracle/communications element manager8.2.2

How to fix CVE-2021-28165

What to do

Three questions, each answered from this record only. Confirm the vendor advisory before you patch.

Should you patch?

CVE-2021-28165 is not in CISA KEV. FIRST estimates a 53.86% chance of exploitation in the next 30 days. Check whether you run In Eclipse Jetty 7.2.2.

Which versions are affected?

Compare what you have installed with oracle/autovue for agile product lifecycle management 21.0.2; oracle/communications cloud native core policy 1.14.0; oracle/communications element manager 8.2.2. Compare the installed version with the linked vendor advisory before you change production.

What should an analyst verify?

CWE-400: Uncontrolled Resource Consumption; CWE-551; CWE-755: Improper Handling of Exceptional Conditions. EPSS 53.86%. There is no CISA KEV listing. No Exploit-DB or Metasploit reference is linked. Use the source links for the original advisory.

Code

The project this record applies to. Exploit listings stay in References.

No public source repository is identified for this product.

Timeline

Detection, updates, and resolution for this record.

  1. Oct 15, 2021 · AlienVault OTX

    Detected

    K15338344: vulnerabilidad del embarcadero de Eclipse CVE-2021-28165 En Eclipse Jetty 7.2.2 a 9.4.38, 10.0.0.alpha0 a 10.0.1 y 11.0.0.alpha0 a 11.0.1, el uso de CPU puede alcanzar el 100% al recibir una gran trama TLS no válida. ( CVE-2021-28165 ) Impacto Los sistemas afectados pueden experimentar agotamiento de recursos cuando reciben una trama TLS grande no válida.

  2. Jun 17, 2026 · Monitored products — critical

    Updated

    In Eclipse Jetty 7.2.2 to 9.4.38, 10.0.0.alpha0 to 10.0.1, and 11.0.0.alpha0 to 11.0.1, CPU usage can reach 100% upon receiving a large invalid TLS frame.

Sources

References

Freshness

Last verified in this catalog Nov 8, 2026. Significant claims (KEV, EPSS, CVSS, affected ranges) come from the source rows above — open the original publisher for the authoritative advisory.

  • CVE.orgNov 4, 2026
  • Monitored products — criticalNov 3, 2026
  • AlienVault OTXNov 2, 2026