CVE-2025-1948
Eclipse Jetty HTTP clients can increase memory allocation
We use these services and cookies to improve your user experience. You may opt out if you wish, however, this may limit some features on this site.
Please see our statement on Data Privacy.
Eclipse Jetty HTTP clients can increase memory allocation
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Reserved 2025-03-04 | Published 2025-05-08 | Updated 2025-05-08 | Assigner eclipseCWE-400 Uncontrolled Resource Consumption
gitlab.eclipse.org/security/cve-assignement/-/issues/56
github.com/...roject/security/advisories/GHSA-889j-63jv-qhr8
Support options
