Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

🗓️ 08 May 2025 19:28:45Reported by GitHub Advisory DatabaseType

Eclipse Jetty HTTP/2 client may cause OutOfMemoryError and JVM exit by forcing large buffer allocation

Reporter	Title	Published	Views	Family All 72
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to an OutOfMemoryError (CVE-2025-1948)	17 Feb 202608:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to Uncontrolled Resource Consumption due to Eclipse Jetty.	1 Oct 202520:28	–	ibm
IBM Security Bulletins	Security Bulletin: Jetty HTTP/2 Unvalidated SETTINGS_MAX_HEADER_LIST_SIZE Leads to Out-of-Memory DoS , affects watsonx.data	4 Dec 202508:41	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in jetty-io affects IBM Netezza Appliance	16 Dec 202509:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to an issue in Eclipse Jetty	1 Oct 202515:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Cognos Command Center	4 Feb 202617:48	–	ibm
Chainguard	CVE-2025-1948 vulnerabilities	12 May 202513:14	–	cgr
Circl	CVE-2025-1948	8 May 202518:24	–	circl
CNNVD	Eclipse Jetty 安全漏洞	8 May 202500:00	–	cnnvd
CVE	CVE-2025-1948	8 May 202517:48	–	cve

Vulners

Node

Source	Link
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-1948
github	www.github.com/jetty/jetty.project/issues/12690
github	www.github.com/jetty/jetty.project/commit/c8c2515936ef968dc8a3cecd9e79d1e69291e4bb
gitlab	www.gitlab.eclipse.org/security/cve-assignement/-/issues/56
github	www.github.com/advisories/GHSA-889j-63jv-qhr8

08 May 2025 19:28Current

6.8Medium risk

Vulners AI Score6.8

CVSS 3.17.5

EPSS0.00576

SSVC