CVE-2022-2191

High

not-fixedPATCH AVAILABLENot Available

CVE-2022-2191

Description

Impact

SslConnection does not release ByteBuffers in case of error code paths. For example, TLS handshakes that require client-auth with clients that send expired certificates will trigger a TLS handshake errors and the ByteBuffers used to process the TLS handshake will be leaked.

Workarounds

Configure explicitly a RetainableByteBufferPool with max[Heap|Direct]Memory to limit the amount of memory that is leaked. Eventually the pool will be full of "active" entries (the leaked ones) and will provide ByteBuffers that will be GCed normally.

With embedded-jetty

int maxBucketSize = 1000;
long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB
long maxDirectMemory = 128 * 1024L * 1024L; // 128 MB
RetainableByteBufferPool rbbp = new ArrayRetainableByteBufferPool(0, -1, -1, maxBucketSize, maxHeapMemory, maxDirectMemory);

server.addBean(rbbp); // make sure the ArrayRetainableByteBufferPool is added before the server is started
server.start();

With jetty-home/jetty-base

Create a ${jetty.base}/etc/retainable-byte-buffer-config.xml

<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">

<Configure id="Server" class="org.eclipse.jetty.server.Server">
  <Call name="addBean">
    <Arg>
      <New class="org.eclipse.jetty.io.ArrayRetainableByteBufferPool">
        <Arg type="int"><Property name="jetty.byteBufferPool.minCapacity" default="0"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.factor" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxCapacity" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxBucketSize" default="1000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxHeapMemory" default="128000000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxDirectMemory" default="128000000"/></Arg>
      </New>
    </Arg>
  </Call>
</Configure>

And then reference it in ${jetty.base}/start.d/retainable-byte-buffer-config.ini

etc/retainable-byte-buffer-config.xml

References

https://github.com/eclipse/jetty.project/issues/8161

For more information

Email us at security@webtide.com

Impact

Workarounds

With embedded-jetty

int maxBucketSize = 1000;
long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB
long maxDirectMemory = 128 * 1024L * 1024L; // 128 MB
RetainableByteBufferPool rbbp = new ArrayRetainableByteBufferPool(0, -1, -1, maxBucketSize, maxHeapMemory, maxDirectMemory);

server.addBean(rbbp); // make sure the ArrayRetainableByteBufferPool is added before the server is started
server.start();

With jetty-home/jetty-base

Create a ${jetty.base}/etc/retainable-byte-buffer-config.xml

<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">

<Configure id="Server" class="org.eclipse.jetty.server.Server">
  <Call name="addBean">
    <Arg>
      <New class="org.eclipse.jetty.io.ArrayRetainableByteBufferPool">
        <Arg type="int"><Property name="jetty.byteBufferPool.minCapacity" default="0"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.factor" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxCapacity" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxBucketSize" default="1000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxHeapMemory" default="128000000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxDirectMemory" default="128000000"/></Arg>
      </New>
    </Arg>
  </Call>
</Configure>

And then reference it in ${jetty.base}/start.d/retainable-byte-buffer-config.ini

etc/retainable-byte-buffer-config.xml

References

https://github.com/eclipse/jetty.project/issues/8161

For more information

Email us at security@webtide.com

Impact Assessment

This high-severity vulnerability could allow attackers to gain unauthorized access, execute arbitrary code, or compromise data integrity. Prompt remediation is strongly recommended.

CVSS v3.1 Score

7.5

EPSS — Exploit Prediction

2.18%

Probability of exploitation in the next 30 days · more likely than 81.8% of all CVEs.

Quick Facts

PublishedJul 12, 2026

Last ModifiedJul 12, 2026

Discovered ByIndependent Security Researcher

Statusnot-fixed

Weakness Types

CWE-404

CWE-664

Attack Metrics

CVSS v3.1 Metrics Breakdown

attack Vector

attack Complexity

privileges Required

user Interaction

scope

Unchanged

confidentiality Impact

High

integrity Impact

High

availability Impact

High

Remediation Guide

How to Fix This Vulnerability

Remediation Steps

1Upgrade the package to version 10.0.10 or later
2Review and audit affected systems for potential exploitation
3Implement additional security controls if immediate patching is not possible
4Monitor for suspicious activity related to this vulnerability

Mitigation Strategies

Immediate Patching

High

Apply security patches to version 10.0.10 immediately

Network Segmentation

High

Isolate affected systems from untrusted networks until patching is complete

Monitoring and Detection

Medium

Implement enhanced monitoring for exploitation attempts and unusual behavior

Event History

Vulnerability Timeline

Vulnerability published

2026-07-12T12:06:09Z

published

Patches released: 10.0.10

2026-07-12T12:06:09Z

patched

▪ Common questions

How severe is CVE-2022-2191?

CVE-2022-2191 is rated HIGH with a CVSS score of 7.5.

How do I fix CVE-2022-2191?

Upgrade the affected package to 10.0.10.

What kind of weakness is CVE-2022-2191?

CVE-2022-2191 is classified as CWE-404 — CVE-2022-2191.

Back to All Vulnerabilities

CVE-2022-2191

High

not-fixedPATCH AVAILABLENot Available

CVE-2022-2191

ShareX LinkedIn Reddit HN

Description

Impact

Workarounds

With embedded-jetty

int maxBucketSize = 1000;
long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB
long maxDirectMemory = 128 * 1024L * 1024L; // 128 MB
RetainableByteBufferPool rbbp = new ArrayRetainableByteBufferPool(0, -1, -1, maxBucketSize, maxHeapMemory, maxDirectMemory);

server.addBean(rbbp); // make sure the ArrayRetainableByteBufferPool is added before the server is started
server.start();

With jetty-home/jetty-base

Create a ${jetty.base}/etc/retainable-byte-buffer-config.xml

<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">

<Configure id="Server" class="org.eclipse.jetty.server.Server">
  <Call name="addBean">
    <Arg>
      <New class="org.eclipse.jetty.io.ArrayRetainableByteBufferPool">
        <Arg type="int"><Property name="jetty.byteBufferPool.minCapacity" default="0"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.factor" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxCapacity" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxBucketSize" default="1000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxHeapMemory" default="128000000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxDirectMemory" default="128000000"/></Arg>
      </New>
    </Arg>
  </Call>
</Configure>

And then reference it in ${jetty.base}/start.d/retainable-byte-buffer-config.ini

etc/retainable-byte-buffer-config.xml

References

https://github.com/eclipse/jetty.project/issues/8161

For more information

Email us at security@webtide.com

Impact

Workarounds

With embedded-jetty

int maxBucketSize = 1000;
long maxHeapMemory = 128 * 1024L * 1024L; // 128 MB
long maxDirectMemory = 128 * 1024L * 1024L; // 128 MB
RetainableByteBufferPool rbbp = new ArrayRetainableByteBufferPool(0, -1, -1, maxBucketSize, maxHeapMemory, maxDirectMemory);

server.addBean(rbbp); // make sure the ArrayRetainableByteBufferPool is added before the server is started
server.start();

With jetty-home/jetty-base

Create a ${jetty.base}/etc/retainable-byte-buffer-config.xml

<?xml version="1.0"?>
<!DOCTYPE Configure PUBLIC "-//Jetty//Configure//EN" "https://www.eclipse.org/jetty/configure_10_0.dtd">

<Configure id="Server" class="org.eclipse.jetty.server.Server">
  <Call name="addBean">
    <Arg>
      <New class="org.eclipse.jetty.io.ArrayRetainableByteBufferPool">
        <Arg type="int"><Property name="jetty.byteBufferPool.minCapacity" default="0"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.factor" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxCapacity" default="-1"/></Arg>
        <Arg type="int"><Property name="jetty.byteBufferPool.maxBucketSize" default="1000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxHeapMemory" default="128000000"/></Arg>
        <Arg type="long"><Property name="jetty.byteBufferPool.maxDirectMemory" default="128000000"/></Arg>
      </New>
    </Arg>
  </Call>
</Configure>

And then reference it in ${jetty.base}/start.d/retainable-byte-buffer-config.ini

etc/retainable-byte-buffer-config.xml

References

https://github.com/eclipse/jetty.project/issues/8161

For more information

Email us at security@webtide.com

Impact Assessment

This high-severity vulnerability could allow attackers to gain unauthorized access, execute arbitrary code, or compromise data integrity. Prompt remediation is strongly recommended.

CVSS v3.1 Score

7.5

EPSS — Exploit Prediction

2.18%

Probability of exploitation in the next 30 days · more likely than 81.8% of all CVEs.

Quick Facts

PublishedJul 12, 2026

Last ModifiedJul 12, 2026

Discovered ByIndependent Security Researcher

Statusnot-fixed

Weakness Types

CWE-404

CWE-664

Attack Metrics

CVSS v3.1 Metrics Breakdown

attack Vector

attack Complexity

privileges Required

user Interaction

scope

Unchanged

confidentiality Impact

High

integrity Impact

High

availability Impact

High

Remediation Guide

How to Fix This Vulnerability

Remediation Steps

1Upgrade the package to version 10.0.10 or later
2Review and audit affected systems for potential exploitation
3Implement additional security controls if immediate patching is not possible
4Monitor for suspicious activity related to this vulnerability

Mitigation Strategies

Immediate Patching

High

Apply security patches to version 10.0.10 immediately

Network Segmentation

High

Isolate affected systems from untrusted networks until patching is complete

Monitoring and Detection

Medium

Implement enhanced monitoring for exploitation attempts and unusual behavior

Event History

Vulnerability Timeline

Vulnerability published

2026-07-12T12:06:09Z

published

Patches released: 10.0.10

2026-07-12T12:06:09Z

patched

▪ Common questions

How severe is CVE-2022-2191?

CVE-2022-2191 is rated HIGH with a CVSS score of 7.5.

How do I fix CVE-2022-2191?

Upgrade the affected package to 10.0.10.

What kind of weakness is CVE-2022-2191?

CVE-2022-2191 is classified as CWE-404 — CVE-2022-2191.

Back to All Vulnerabilities