SB2026091662 - Multiple vulnerabilities in Jetty

Description

This security bulletin contains information about 2 vulnerabilities.

1) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-19204)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with an excessive size value in the Jetty WebSocket frame parser\'s Parser.parsePayload method when processing a WebSocket frame with a reserved opcode and an oversized declared payload length. A remote attacker can send a specially crafted WebSocket frame header to cause a denial of service.

Auto-fragmentation is enabled by default, and reserved opcodes bypass the applicable frame-size checks before opcode validation occurs.

2) Resource exhaustion (CVE-ID: CVE-2026-12611)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of a flusher termination race in HTTP2Flusher when processing HTTP/2 requests with blocked response writes and concurrent RST_STREAM and GOAWAY frames. A remote attacker can send crafted HTTP/2 requests that block response writes and then send RST_STREAM and GOAWAY frames to cause a denial of service.

Remediation

Install update from vendor's website.

References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g
• https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3