In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.
The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
CVSS
No CVSS.
References
| Link | Resource |
|---|---|
| https://github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8 | Vendor Advisory |
| https://gitlab.eclipse.org/security/cve-assignement/-/issues/56 | Issue Tracking |
Configurations
History
31 Jul 2025, 16:28
| Type | Values Removed | Values Added |
|---|---|---|
| CPE | cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | |
| First Time |
Eclipse jetty
Eclipse |
|
| References | () https://gitlab.eclipse.org/security/cve-assignement/-/issues/56 - Issue Tracking | |
| References | () https://github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8 - Vendor Advisory |
08 May 2025, 18:15
| Type | Values Removed | Values Added |
|---|---|---|
| New CVE |
Information
Published : 2025-05-08 18:15
Updated : 2025-07-31 16:28
NVD link : CVE-2025-1948
Mitre link : CVE-2025-1948
JSON object : View
Products Affected
eclipse
- jetty
CWE
No CWE.