CVE-2026-19204
published 2026-09-07CVE-2026-19204: A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and…
PriorityP346high8.7CVSS 4.0
AVNACLATNPRNUINVCNVINVAHSCNSINSANEXCRXIRXARXMAVXMACXMATXMPRXMUIXMVCXMVIXMVAXMSCXMSIXMSAXSXAUXRXVXREXUX
EPSS
0.31%
22.6th percentile
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.
This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | puppetserver | — | — |
| eclipse_foundation | eclipse_jetty | 10.0.0 – 10.0.31 | — |
| eclipse_foundation | eclipse_jetty | 11.0.0 – 11.0.31 | — |
| eclipse_foundation | eclipse_jetty | 12.0.0 – 12.0.37 | — |
| eclipse_foundation | eclipse_jetty | 12.1.0 – 12.1.11 | — |
CVSS provenance
nvdv4.08.7HIGHCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat8.7HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Red Hat
org.eclipse.jetty.websocket/websocket-core-common: Jetty: Denial of Service via crafted WebSocket frame with unknown opcode
vendor_redhat·2026-09-07·CVSS 8.7
CVE-2026-19204 [HIGH] CWE-789 org.eclipse.jetty.websocket/websocket-core-common: Jetty: Denial of Service via crafted WebSocket frame with unknown opcode
org.eclipse.jetty.websocket/websocket-core-common: Jetty: Denial of Service via crafted WebSocket frame with unknown opcode
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.
This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending a specially crafted WebSocket frame with an unknown operation code (opcode) and a very large declared payload length. When auto-fragmentation is enabled, these unknown opcodes bypass the normal maximum frame size handling,
GHSA
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.
ghsa_unreviewed·2026-09-07
CVE-2026-19204 [HIGH] CWE-770 A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.
This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
No detection rules found.
No public exploits indexed.
2026-09-07
Published