Kurz gesagt
- CVE-2025-1948 ist eine Schwachstelle (HOCH (CVSS 7.5)) in org.eclipse.jetty.http2:jetty-http2-common, jetty (eclipse).
- Wahrscheinlichkeit einer Ausnutzung in den nächsten 30 Tagen (EPSS): 0.78%, höher als bei 56.0% aller Schwachstellen.
- Abhilfe: auf 12.0.17 oder neuer aktualisieren.
Description
Original Report
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Impact
Remote peers can cause the JVM to crash or continuously report OOM.
Patches
12.0.17
Workarounds
No workarounds.
References
https://github.com/jetty/jetty.project/issues/12690
NVD description
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.
The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Weitere Schwachstellen in org.eclipse.jetty.http2:jetty-http2-common
Alle anzeigen →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free