Skip to content
CVE PROGRAM SOURCE RECORD8.7 High

CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the

Read JSON ↗CVE.org ↗
Status
Published
Published
Updated
Assigning organization
eclipse

Description

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Affected products

Version statuses are supplied by the assigning organization. Consult the original record for detailed ranges and platform conditions.

Eclipse Foundation Eclipse Jetty

Default version status: unaffected

  • 12.1.0 to ≤ 12.1.11affected
  • 12.0.0 to ≤ 12.0.37affected
  • 11.0.0 to ≤ 11.0.31affected
  • 10.0.0 to ≤ 10.0.31affected

References