CVE-2026-19204
8.7
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Summary
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.
This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
Affected Software
| Vendor | Product | Version Range | Status |
|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | 12.1.0 <= 12.1.11 | affected |
| Eclipse Foundation | Eclipse Jetty | 12.0.0 <= 12.0.37 | affected |
| Eclipse Foundation | Eclipse Jetty | 11.0.0 <= 11.0.31 | affected |
| Eclipse Foundation | Eclipse Jetty | 10.0.0 <= 10.0.31 | affected |
Weaknesses
- CWE-770: CWE-770 Allocation of resources without limits or throttling
- CWE-789: CWE-789 Memory allocation with excessive size value
References
Feedback
Was this page helpful?
Glad to hear it! Please tell us how we can improve.
Sorry to hear that. Please tell us how we can improve.