CVE-2026-19204

EUVD-2026-72335
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.




This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
eclipseCNA
8.7 HIGH
NETWORK
LOW
NONE
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Base Score
CVSS 3.x
EPSS Score
Percentile: 21.56%
Early Detection
Affected products identified ahead of NVD analysis through intelligence sources.
VendorProductVersionSource
eclipsejetty
12.1.0 ≤
𝑥
≤ 12.1.11
CNA
eclipsejetty
12.0.0 ≤
𝑥
≤ 12.0.37
CNA
eclipsejetty
11.0.0 ≤
𝑥
≤ 11.0.31
CNA
eclipsejetty
10.0.0 ≤
𝑥
≤ 10.0.31
CNA
Debian logo
Debian Releases
Debian Product
Codename
jetty12
forky
undetermined
sid
undetermined
trixie
undetermined
trixie (security)
undetermined
jetty9
bookworm
undetermined
bookworm (security)
undetermined
forky
undetermined
sid
undetermined
trixie
undetermined
trixie (security)
undetermined
Common Weakness Enumeration
Vulnerability Media Exposure
References
https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g