CVE-2025-1948

Eclipse Jetty HTTP clients can increase memory allocation

Description

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Scores

Weaknesses (CWE)

• CWE-400

Advisories

• GHSA-889j-63jv-qhr8 — Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

European references

• ENISA EUVD · EUVD-2025-14031
• GCVE · GCVE-0-2025-1948

CERT-FR advisories

• CERTFR-2026-AVI-0627 — Multiples vulnérabilités dans les produits Splunk · cert.ssi.gouv.fr
• CERTFR-2026-AVI-0131 — Multiples vulnérabilités dans les produits IBM · cert.ssi.gouv.fr
• CERTFR-2025-AVI-0844 — Multiples vulnérabilités dans IBM Sterling Connect · cert.ssi.gouv.fr

Affected configurations (NVD CPE)

• cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* ≥ 12.0.0 < 12.0.17

Affected products

References

• https://gitlab.eclipse.org/security/cve-assignement/-/issues/56
• https://github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8

Sources