Log in Start free

Vulnerability · Published Sep 7, 2026 · Assigned by eclipse

CVE-2026-19204

High 8.7

In plain English

A high-severity resource allocation without limits in Eclipse Jetty from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.5% (higher than 40% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.5%top 60.4% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13jetty12no fix listedDEBIAN-CVE-2026-19204
Debian:14jetty1212.0.39-1DEBIAN-CVE-2026-19204
Ubuntu:26.04:LTSjetty12no fix listedUBUNTU-CVE-2026-19204
Ubuntu:26.10jetty12no fix listedUBUNTU-CVE-2026-19204
Ubuntu:22.04:LTSjetty9no fix listedUBUNTU-CVE-2026-19204
Ubuntu:24.04:LTSjetty9no fix listedUBUNTU-CVE-2026-19204
Ubuntu:26.04:LTSjetty9no fix listedUBUNTU-CVE-2026-19204
Ubuntu:26.10jetty9no fix listedUBUNTU-CVE-2026-19204

Affected products (as reported)

VendorProductVersions
Eclipse Foundation Eclipse Jetty 12.1.0 – through 12.1.1112.0.0 – through 12.0.3711.0.0 – through 11.0.3110.0.0 – through 10.0.31

Weakness: CWE-770, CWE-789 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References