p PatchFirst

CVE-2025-1948

CVE-2025-1948 · Eclipse Jetty HTTP clients can increase memory allocation

This page contains facts from public vulnerability sources. Check the original advisory before updating.

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

CVSS 7.5 · High · EPSS 0.8% · Fix available

Published
Updated

Stack: system

Affected products and versions

  • jetty

    Versions
    • ≥ 12.0.0, ≤ 12.0.16: Affected (semver)

    No fix published

  • jetty12 Debian:13

    Affected ranges
    • ECOSYSTEM: < 12.0.17-1

    Update to 12.0.17-1

  • jetty12 Debian:14

    Affected ranges
    • ECOSYSTEM: < 12.0.17-1

    Update to 12.0.17-1

  • jetty Ubuntu:14.04:LTS

    Versions
    • 6.1.26-1ubuntu1
    • 6.1.26-1ubuntu1.1
    • 6.1.26-1ubuntu1.2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty Ubuntu:16.04:LTS

    Versions
    • 6.1.26-5
    • 6.1.26-5ubuntu0.1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:16.04:LTS

    Versions
    • 9.2.14-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:18.04:LTS

    Versions
    • 9.2.22-2
    • 9.2.22-3
    • 9.2.23-1
    • 9.4.15-1~18.04.1ubuntu1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:20.04:LTS

    Versions
    • 9.4.18-2build2
    • 9.4.26-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:22.04:LTS

    Versions
    • 9.4.39-3
    • 9.4.44-2
    • 9.4.44-3
    • 9.4.44-4
    • 9.4.45-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:24.04:LTS

    Versions
    • 9.4.51-2
    • 9.4.53-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:25.10

    Versions
    • 9.4.56-1
    • 9.4.57-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:26.10

    Versions
    • 9.4.58-1
    • 9.4.58-2
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

  • jetty9 Ubuntu:26.04:LTS

    Versions
    • 9.4.57-1
    • 9.4.57-1.1
    • 9.4.58-1
    Affected ranges
    • ECOSYSTEM: (−∞, +∞)

    No fix published

Original sources

Check your server →