jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability

🗓️ 15 May 2025 15:17:00Reported by RedHatType

redhat

redhat🔗 access.redhat.com👁 7 Views

Jetty HTTP/2 denial of service when a client sets a very large SETTINGS_MAX_HEADER_LIST_SIZE.

Reporter	Title	Published	Views	Family All 73
IBM Security Bulletins	Security Bulletin: IBM Event Streams is vulnerable to an OutOfMemoryError (CVE-2025-1948)	17 Feb 202608:44	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for UNIX is vulnerable to Uncontrolled Resource Consumption due to Eclipse Jetty.	1 Oct 202520:28	–	ibm
IBM Security Bulletins	Security Bulletin: Jetty HTTP/2 Unvalidated SETTINGS_MAX_HEADER_LIST_SIZE Leads to Out-of-Memory DoS , affects watsonx.data	4 Dec 202508:41	–	ibm
IBM Security Bulletins	Security Bulletin:Vulnerability in jetty-io affects IBM Netezza Appliance	16 Dec 202509:33	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Connect:Direct for Microsoft Windows is vulnerable to an issue in Eclipse Jetty	1 Oct 202515:20	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Cognos Command Center	4 Feb 202617:48	–	ibm
Chainguard	CVE-2025-1948 vulnerabilities	12 May 202513:14	–	cgr
Circl	CVE-2025-1948	8 May 202518:24	–	circl
CNNVD	Eclipse Jetty 安全漏洞	8 May 202500:00	–	cnnvd
CVE	CVE-2025-1948	8 May 202517:48	–	cve

Vulners

Node

AND

redhat apache_camel_spring_bootRange<4.10.3

redhat enterprise_linux

Source	Link
access	www.access.redhat.com/security/cve/CVE-2025-1948
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8
gitlab	www.gitlab.eclipse.org/security/cve-assignement/-/issues/56
nvd	www.nvd.nist.gov/vuln/detail/CVE-2025-1948
cve	www.cve.org/CVERecord

18 Mar 2026 03:00Current

7High risk

Vulners AI Score7

CVSS 3.17.5

EPSS0.00625

SSVC

Jetty Hypertext Transfer Protocol Header List Size Settings List Size Vulnerability