Security Bulletin: Due to the use of Jetty, IBM Sterling Control Center is vulnerable to Allocation of Resources Without Limits or Throttling (CVE-2026-19204)

Summary Jetty is used by IBM Sterling Control Center as part of dependency in jetty-websocket-core-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19204 DESCRIPTION: A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to...

ANT-2026-Y9CTVKPP · jetty/jetty.project · Denial of Service / Resource Exhaustion

denial-of-service high GHSA-85fq-fc5f-7j7g Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-Y9CTVKPP: WebSocket reserved opcode...

Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in its WebSocket frame parsing, where a frame carrying an unknown opcode bypasses the maximum frame size validation and its declared payload length is allocated before the opcode is...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +431 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.1.0.alpha0, <=12.1.11)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.1.0.alpha0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =4.13.5, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.3 and more Source cves: CVE-2026-19204 Source advisory: SNYK:JAVA-ORGECLIPSEJETTYWEBSOCKET-19644206...

au.csiro.pathling:fhir-server (>=7.0.0, <=7.2.0), br.com.archbase:archbase-annotation-processor (>=2.1.2, <=2.1.21) +292 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.0.0.alpha0, <=12.0.37)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.0.0.alpha0, =7.0.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-19204 Source advisory:...

CVE-2026-19204

Eclipse Jetty is vulnerable in its WebSocket component when auto-fragmentation is enabled. A remote, unauthenticated client can send a WebSocket frame with an unknown opcode and a very large declared payload length. Because unknown opcodes bypass the normal maximum frame size handling and payload...

EUVD-2026-72335

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size...

au.csiro.pathling:fhir-server (>=7.0.0, <=7.2.0), br.com.archbase:archbase-annotation-processor (>=2.1.2, <=2.1.21) +288 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.0.0, <=12.0.37)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.0.0, =7.0.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-19204 Source advisory: MEND:CVE-2026-19204...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +427 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.1.0, <=12.1.11)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.1.0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =4.13.5, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.3 and more Source cves: CVE-2026-19204 Source advisory: MEND:CVE-2026-19204...