← CVE Intelligence

CVE-2026-19204

Eclipse Foundation / Eclipse Jetty PUBLISHED

Description (CNA)

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Affected (CNA)

Vendor / productVersions
Eclipse Foundation / Eclipse Jettyaffected 12.1.0 through 12.1.11; affected 12.0.0 through 12.0.37; affected 11.0.0 through 11.0.31; affected 10.0.0 through 10.0.31

CWE

CWE-770, CWE-789

References

ADP enrichment

CISA-ADP

No English description supplied.

No references supplied.