PT-2025-20402 · Eclipse · Eclipse Jetty

Name of the Vulnerable Software and Affected Versions: Eclipse Jetty versions 12.0.0 through 12.0.16 Description: The issue arises when an HTTP/2 client specifies a very large value for the HTTP/2 settings parameter SETTINGS MAX HEADER LIST SIZE. The Jetty HTTP/2 server fails to validate this...