Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

Mô tả

Tham khảo

• jetty/jetty.project security advisory · WEB
• nvd.nist.gov/vuln/detail/CVE-2025-1948 · ADVISORY
• jetty/jetty.project · WEB
• jetty/jetty.project commit c8c2515 · WEB
• jetty/jetty.project · PACKAGE
• gitlab.eclipse.org/security/cve-assignement/-/issues/56 · WEB

Lỗ hổng khác của org.eclipse.jetty.http2:jetty-http2-common

• CVE-2025-5115CAO 7.5In Eclipse Jetty, versions <=9.4.57, <=10.0.25, <=11.0.25, <=12.0.21, <=12.1.0.alpha2, an HTTP/2 client may trigger the server to send RST_S…
• CVE-2024-22201CAO 7.5Jetty is a Java based web server and servlet engine. An HTTP/2 SSL connection that is established and TCP congested will be leaked when it t…
• CVE-2023-44487CAO 7.5ĐANG BỊ KHAI THÁC (CISA KEV)The HTTP/2 protocol allows a denial of service (server resource consumption) because request cancellation can reset many streams quickly, as…