Security Bulletin: Due to the use of Jetty, IBM Sterling Control Center is vulnerable to Allocation of Resources Without Limits or Throttling (CVE-2026-19204)

Summary Jetty is used by IBM Sterling Control Center as part of dependency in jetty-websocket-core-common-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-19204 DESCRIPTION: A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to...

ANT-2026-Y9CTVKPP · jetty/jetty.project · Denial of Service / Resource Exhaustion

denial-of-service high GHSA-85fq-fc5f-7j7g Severity Claude high · Security research firm high · Maintainer - Discovered by Claude Mythos Preview REPORT Anthropic's analysis, sealed at approval. Disclosure to the maintainer was performed by Ada Logics. ANT-2026-Y9CTVKPP: WebSocket reserved opcode...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +431 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.1.0.alpha0, <=12.1.11)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.1.0.alpha0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =4.13.5, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.3 and more Source cves: CVE-2026-19204 Source advisory: SNYK:JAVA-ORGECLIPSEJETTYWEBSOCKET-19644206...

au.csiro.pathling:fhir-server (>=7.0.0, <=7.2.0), br.com.archbase:archbase-annotation-processor (>=2.1.2, <=2.1.21) +292 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.0.0.alpha0, <=12.0.37)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.0.0.alpha0, =7.0.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-19204 Source advisory:...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +427 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.1.0, <=12.1.11)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.1.0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =4.13.5, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.0, =3.30.3 and more Source cves: CVE-2026-19204 Source advisory: MEND:CVE-2026-19204...

au.csiro.pathling:fhir-server (>=7.0.0, <=7.2.0), br.com.archbase:archbase-annotation-processor (>=2.1.2, <=2.1.21) +288 more potentially affected by CVE-2026-19204 via org.eclipse.jetty.websocket:jetty-websocket-core-common (>=12.0.0, <=12.0.37)

org.eclipse.jetty.websocket:jetty-websocket-core-common MAVEN version =12.0.0, =7.0.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-19204 Source advisory: MEND:CVE-2026-19204...

Unspecified Vulnerability in Oracle Secure Global Desktop WebSocket SGD Core Component

Oracle Secure Global Desktop is a desktop virtualization product that gives users access to server-hosted applications and server-hosted desktops. An unspecified vulnerability in the SGD Core component of Oracle Secure Global Desktop WebSocket allows remote attackers to exploit the vulnerability ...