GitHub Advisoryadvisory · Maven

GHSA-889j-63jv-qhr8 Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

HIGH Published 2025-05-08 Modified 2025-05-08 Official page ↗
Aliases
CVE-2025-1948
Ecosystem
Maven
Packages
org.eclipse.jetty.http2:jetty-http2-common
Severity
High
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weaknesses
CWE-400
Reviewed
2025-05-08

Affected packages

• Maven org.eclipse.jetty.http2:jetty-http2-common: >= 12.0.0, < 12.0.17 → fixed in 12.0.17

Description

Original Report In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting. Impact Remote peers can cause the JVM to crash or continuously report OOM. Patches 12.0.17 Workarounds No workarounds. References https://github.com/jetty/jetty.project/issues/12690

Related

Alias · CVE (1)

  • CVE-2025-1948 In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter… vulnerability

Weakness · CWE (1)

  • CWE-400 Uncontrolled Resource Consumption weakness

References