@Scottmitch thanks for the heads-up buddy.
 @normanmaurer - Sure I can take this, but I have some outstanding questions for the alpn-boot folks.  They are not planning on back porting the alpn-boot bug fix because there was some updates in OpenJDK SSL related code (not related to this bug).   Seems a bit limiting to only have the "newest" version "functional" (or at least no known bugs) because the alpn-boot versions are jdk dependent....
 @Scottmitch yeah this sound not good :(
 Two PRs were submitted upstream to the alpn-boot project to backport fixes:

JDK7: https://github.com/jetty-project/jetty-alpn/pull/7 
JDK8: https://github.com/jetty-project/jetty-alpn/pull/6
 Addressed by https://github.com/netty/netty/pull/3254.

alpn-boot folks have decided to leave previous versions vulnerable to this and any future bugs.  To me this sounds like versions of alpn-boot that do not correspond to the most current version (for their respective JDK 7 or 8) are deprecated.  I have asked for them to clarify this on their website (or somewhere) but have not reached clarity on this issue yet.

Jetty alpn-boot new version
Due to https://github.com/jetty-project/jetty-alpn/issues/5 there will be a new alpn-boot release.  The pom files should be updated to reflect this.

pom.xml
pom.xml
diff --git a/pom.xml b/pom.xml
index 0f64bb1e754..594f7699d61 100644
--- a/pom.xml
+++ b/pom.xml
@@ -108,9 +108,54 @@
       <properties>
         <!-- Our Javadoc has poor enough quality to fail the build thanks to JDK8 javadoc which got more strict. -->
         <maven.javadoc.failOnError>false</maven.javadoc.failOnError>
-        <!-- npn-boot does not work with JDK 8 -->
+      </properties>
+    </profile>
+    <profile>
+      <id>alpn-8</id>
+      <activation>
+        <property>
+          <name>java.version</name>
+          <value>1.8</value>
+        </property>
+      </activation>
+      <properties>
+        <jetty.alpn.version>8.1.0.v20141016</jetty.alpn.version>
+      </properties>
+    </profile>
+    <profile>
+      <id>alpn-8u05</id>
+      <activation>
+        <property>
+          <name>java.version</name>
+          <value>1.8.0_05</value>
+        </property>
+      </activation>
+      <properties>
+        <jetty.alpn.version>8.1.0.v20141016</jetty.alpn.version>
+      </properties>
+    </profile>
+    <profile>
+      <id>alpn-8u11</id>
+      <activation>
+        <property>
+          <name>java.version</name>
+          <value>1.8.0_11</value>
+        </property>
+      </activation>
+      <properties>
+        <jetty.alpn.version>8.1.0.v20141016</jetty.alpn.version>
+      </properties>
+    </profile>
+    <profile>
+      <id>alpn-8u20</id>
+      <activation>
+        <property>
+          <name>java.version</name>
+          <value>1.8.0_20</value>
+        </property>
+      </activation>
+      <properties>
         <jetty.alpn.version>8.1.0.v20141016</jetty.alpn.version>
-        <argLine.bootcp>-Xbootclasspath/p:${jetty.alpn.path}</argLine.bootcp>
       </properties>
     </profile>
     <profile>
@@ -122,7 +167,7 @@
         </property>
       </activation>
       <properties>
-        <jetty.alpn.version>8.1.1.v20141016</jetty.alpn.version>
+        <jetty.alpn.version>8.1.2.v20141202</jetty.alpn.version>
       </properties>
     </profile>
     <profile>
@@ -296,7 +341,6 @@
       <properties>
         <jetty.npn.version>1.1.6.v20130911</jetty.npn.version>
         <jetty.alpn.version>7.1.0.v20141016</jetty.alpn.version>
-        <!-- Defer definition of Xbootclasspath to default or forcenpn profile -->
       </properties>
     </profile>
     <profile>
@@ -310,7 +354,6 @@
       <properties>
         <jetty.npn.version>1.1.6.v20130911</jetty.npn.version>
         <jetty.alpn.version>7.1.0.v20141016</jetty.alpn.version>
-        <!-- Defer definition of Xbootclasspath to default or forcenpn profile -->
       </properties>
     </profile>
     <profile>
@@ -324,7 +367,6 @@
       <properties>
         <jetty.npn.version>1.1.6.v20130911</jetty.npn.version>
         <jetty.alpn.version>7.1.0.v20141016</jetty.alpn.version>
-        <!-- Defer definition of Xbootclasspath to default or forcenpn profile -->
       </properties>
     </profile>
     <profile>
@@ -338,7 +380,6 @@
       <properties>
         <jetty.npn.version>1.1.8.v20141013</jetty.npn.version>
         <jetty.alpn.version>7.1.0.v20141016</jetty.alpn.version>
-        <!-- Defer definition of Xbootclasspath to default or forcenpn profile -->
       </properties>
     </profile>
     <profile>
@@ -352,7 +393,6 @@
       <properties>
         <jetty.npn.version>1.1.8.v20141013</jetty.npn.version>
         <jetty.alpn.version>7.1.0.v20141016</jetty.alpn.version>
-        <!-- Defer definition of Xbootclasspath to default or forcenpn profile -->
       </properties>
     </profile>
     <profile>
@@ -366,7 +406,6 @@
       <properties>
         <jetty.npn.version>1.1.8.v20141013</jetty.npn.version>
         <jetty.alpn.version>7.1.0.v20141016</jetty.alpn.version>
-        <!-- Defer definition of Xbootclasspath to default or forcenpn profile -->
       </properties>
     </profile>
     <profile>
@@ -380,7 +419,6 @@
       <properties>
         <jetty.npn.version>1.1.8.v20141013</jetty.npn.version>
         <jetty.alpn.version>7.1.0.v20141016</jetty.alpn.version>
-        <!-- Defer definition of Xbootclasspath to default or forcenpn profile -->
       </properties>
     </profile>
     <profile>
@@ -393,8 +431,7 @@
       </activation>
       <properties>
         <jetty.npn.version>1.1.9.v20141016</jetty.npn.version>
-        <jetty.alpn.version>7.1.0.v20141016</jetty.alpn.version>
-        <!-- Defer definition of Xbootclasspath to default or forcenpn profile -->
+        <jetty.alpn.version>7.1.2.v20141202</jetty.alpn.version>
       </properties>
     </profile>
     <profile>
@@ -407,8 +444,7 @@
       </activation>
       <properties>
         <jetty.npn.version>1.1.9.v20141016</jetty.npn.version>
-        <jetty.alpn.version>7.1.0.v20141016</jetty.alpn.version>
-        <!-- Defer definition of Xbootclasspath to default or forcenpn profile -->
+        <jetty.alpn.version>7.1.2.v20141202</jetty.alpn.version>
       </properties>
     </profile>
     <profile>
@@ -436,7 +472,7 @@
     <jboss.marshalling.version>1.3.18.GA</jboss.marshalling.version>
     <jetty.npn.version>1.1.9.v20141016</jetty.npn.version>
     <jetty.npn.path>${settings.localRepository}/org/mortbay/jetty/npn/npn-boot/${jetty.npn.version}/npn-boot-${jetty.npn.version}.jar</jetty.npn.path>
-    <jetty.alpn.version>8.1.0.v20141016</jetty.alpn.version>
+    <jetty.alpn.version>8.1.2.v20141202</jetty.alpn.version>
     <jetty.alpn.path>${settings.localRepository}/org/mortbay/jetty/alpn/alpn-boot/${jetty.alpn.version}/alpn-boot-${jetty.alpn.version}.jar</jetty.alpn.path>
     <argLine.common>
       -server
