En bref
- CVE-2025-1948 est une vulnérabilité ÉLEVÉE (CVSS 7.5) touchant org.eclipse.jetty.http2:jetty-http2-common, jetty (eclipse).
- Probabilité d'exploitation dans les 30 prochains jours (EPSS) : 0.78%, plus élevée que 55.9% des vulnérabilités.
- Correctif : mettre à jour vers 12.0.17 ou plus récent.
Description
Original Report
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Impact
Remote peers can cause the JVM to crash or continuously report OOM.
Patches
12.0.17
Workarounds
No workarounds.
References
https://github.com/jetty/jetty.project/issues/12690
NVD description
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.
The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Autres vulnérabilités de org.eclipse.jetty.http2:jetty-http2-common
Tout voir →Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free