SB2026091662 - Multiple vulnerabilities in Jetty

Description

This security bulletin contains information about 3 vulnerabilities.

1) Uncontrolled Memory Allocation (CVE-ID: CVE-2026-19204)

CWE-ID: CWE-789 - Uncontrolled Memory Allocation

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to memory allocation with an excessive size value in the Jetty WebSocket frame parser's Parser.parsePayload method when processing a WebSocket frame with a reserved opcode and an oversized declared payload length. A remote attacker can send a specially crafted WebSocket frame header to cause a denial of service.

Auto-fragmentation is enabled by default, and reserved opcodes bypass the applicable frame-size checks before opcode validation occurs.

2) Resource exhaustion (CVE-ID: CVE-2026-12611)

CWE-ID: CWE-400 - Resource exhaustion

CVSSv4: 8.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to cause a denial of service.

The vulnerability exists due to improper handling of a flusher termination race in HTTP2Flusher when processing HTTP/2 requests with blocked response writes and concurrent RST_STREAM and GOAWAY frames. A remote attacker can send crafted HTTP/2 requests that block response writes and then send RST_STREAM and GOAWAY frames to cause a denial of service.

3) Inconsistent interpretation of HTTP requests (CVE-ID: CVE-2026-19203)

CWE-ID: CWE-444 - Inconsistent Interpretation of HTTP Requests ('HTTP Request Smuggling')

CVSSv4: 8.3 [CVSS:4.0/AV:N/AC:L/AT:P/PR:N/UI:N/VC:L/VI:H/VA:N/SC:N/SI:N/SA:N]

The vulnerability allows a remote attacker to perform HTTP request smuggling attacks.

The vulnerability exists due to inconsistent interpretation of HTTP requests in the HTTP chunk extension parser when processing a crafted chunked HTTP request containing a line feed in a chunk extension. A remote attacker can send a specially crafted chunked HTTP request to perform HTTP request smuggling attacks.

RFC7230 and RFC2616 compliance modes permit the line-feed condition.

Remediation

Install update from vendor's website.

References

• https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g
• https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3
• https://github.com/jetty/jetty.project/security/advisories/GHSA-xc35-c22g-239h