A race condition in Jetty’s HTTP/2 implementation allows a client to send RST_STREAM and GOAWAY frames that reset an internal flusher flag. This reset causes queued write requests to never be processed, keeping write‑blocked threads busy until the server exhausts all available threads and becomes unresponsive. The vulnerability permits an attacker to force a denial of service on the affected Jetty server.

The affected product is the Eclipse Jetty HTTP/2 server provided by the Eclipse Foundation. No specific version range is listed, so all versions before the fix are considered vulnerable until the patch is applied.

With a CVSS score of 8.7, this issue is considered high severity. The EPSS score is not available, and the vulnerability is not listed in the CISA KEV catalog. The attack vector is inferred to be a client over an HTTP/2 connection that can send malformed or out‑of‑order control frames. Once triggered, the server’s thread pool becomes saturated and the service becomes unreachable, enabling potential disruption of availability for users.