CLEANSTART-2026-VO81158 client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap

🗓️ 23 Oct 2026 00:37:46Reported by GoogleType

osv_cleanstart🔗 osv.dev👁 2 Views

WebSocket frame with unknown opcode in Rundeck causes JVM heap exhaustion.

Reporter	Title	Published	Views	Family All 24
IBM Security Bulletins	Security Bulletin: Due to the use of Jetty, IBM Sterling Control Center is vulnerable to Allocation of Resources Without Limits or Throttling (CVE-2026-19204)	3 Oct 202609:54	–	ibm
CVE	CVE-2026-19204	7 Sep 202610:19	–	cve
Cvelist	CVE-2026-19204	7 Sep 202610:19	–	cvelist
Debian CVE	CVE-2026-19204	7 Sep 202610:19	–	debiancve
EUVD	EUVD-2026-72335	7 Sep 202610:19	–	euvd
Mend	CVE-2026-19204	7 Sep 202610:19	–	mend
NVD	CVE-2026-19204	7 Sep 202611:17	–	nvd
osv_cleanstart	CLEANSTART-2026-SV46004 client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap	20 Sep 202600:37	–	osv_cleanstart
osv_cleanstart	CLEANSTART-2026-TT31497 client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap	22 Oct 202600:39	–	osv_cleanstart
osv_clsa	CLSA-2026-1787893054 TuxCare security update for 123 packages (3 CVEs)	28 Aug 202604:57	–	osv_clsa

Source	Link
github	www.github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VO81158.json
osv	www.osv.dev/vulnerability/CVE-2026-19204
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-19204

23 Oct 2026 00:45Current

5.8Medium risk

Vulners AI Score5.8

CVSS 48.7

EPSS0.0031

Rundeck WebSocket JVM heap exhaustion unknown opcode