Every CVE Search/ Get API key

CVE-2025-1948

Eclipse Jetty HTTP clients can increase memory allocation

7.5 HighFix available

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Attack profile

How easy it is to exploit

Attack vector
Network
Complexity
Low
Privileges needed
None
User interaction
None

What an attacker can affect

Confidentiality
None
Integrity
None
Availability
High

Exploit likelihood

0.78%Up 0.7 points since May 9, 2025
90%50%10%1%

What each source reports

CVE List Score used 7.5

Eclipse Jetty HTTP clients can increase memory allocation

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Record
CVE-2025-1948
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
EUVDEUVD-2025-14031 7.5

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Record
EUVD-2025-14031
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
GitHub AdvisoriesGHSA-889j-63jv-qhr8 7.5

Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

Original Report

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Impact

Remote peers can cause the JVM to crash or continuously report OOM.

Patches

12.0.17

Workarounds

No workarounds.

References

https://github.com/jetty/jetty.project/issues/12690

Record
GHSA-889j-63jv-qhr8
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
NVD 7.5

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Record
CVE-2025-1948
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSV 7.5

Eclipse Jetty HTTP clients can increase memory allocation

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Record
CVE-2025-1948
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVDEBIAN-CVE-2025-1948 7.5

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Record
DEBIAN-CVE-2025-1948
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
Show 10 moreShow less
OSVGHSA-889j-63jv-qhr8 7.5

Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

Original Report

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Impact

Remote peers can cause the JVM to crash or continuously report OOM.

Patches

12.0.17

Workarounds

No workarounds.

References

https://github.com/jetty/jetty.project/issues/12690

Record
GHSA-889j-63jv-qhr8
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Weakness
CWE-400
Updated
2026-11-02
OSVRHSA-2025:10092 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update

Record
RHSA-2025:10092
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:10097 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update

Record
RHSA-2025:10097
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:10098 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update

Record
RHSA-2025:10098
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:10104 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update

Record
RHSA-2025:10104
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:10118 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update

Record
RHSA-2025:10118
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:10119 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update

Record
RHSA-2025:10119
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVRHSA-2025:10120 7.5

Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update

Record
RHSA-2025:10120
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVUBUNTU-CVE-2025-1948 7.5

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Record
UBUNTU-CVE-2025-1948
CVSS 3.1
7.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Updated
2026-11-02
OSVROOT-APP-MAVEN-CVE-2025-1948 No score

CVE-2025-1948 in org.eclipse.jetty.http2:jetty-http2-common - Patched by Root

Root has patched CVE-2025-1948 in the org.eclipse.jetty.http2:jetty-http2-common package for Root:Maven. Multiple fixed versions available.

Record
ROOT-APP-MAVEN-CVE-2025-1948
Updated
2026-11-02

Affected products

Affected packages

Affected packages
PackageAffectedFixed
org.eclipse.jetty.http2:jetty-http2-common
Maven
 12.0.0 to 12.0.16
12.0.17
jetty12
Debian:13
 before 12.0.17-1
12.0.17-1
jetty12
Debian:14
 before 12.0.17-1
12.0.17-1
org.eclipse.jetty.http2:jetty-http2-common
Maven
 12.0.0 up to 12.0.17, plus listed versions
12.0.112.0.1012.0.1112.0.1212.0.13
Show 11 moreShow less
12.0.1412.0.1512.0.1612.0.212.0.312.0.412.0.512.0.612.0.712.0.812.0.9
12.0.17
jenkins
Red Hat:ocp_tools:4.18::el9
From an advisory covering 4 CVEs
 before 0:2.504.2.1750846524-3.el9
0:2.504.2.1750846524-3.el9
jenkins-2-plugins
Red Hat:ocp_tools:4.18::el9
From an advisory covering 4 CVEs
 before 0:4.18.1750846854-1.el9
0:4.18.1750846854-1.el9
jenkins
Red Hat:ocp_tools:4.17::el9
From an advisory covering 4 CVEs
 before 0:2.504.2.1750851690-3.el9
0:2.504.2.1750851690-3.el9
jenkins-2-plugins
Red Hat:ocp_tools:4.17::el9
From an advisory covering 4 CVEs
 before 0:4.17.1750851950-1.el9
0:4.17.1750851950-1.el9
jenkins
Red Hat:ocp_tools:4.16::el9
From an advisory covering 4 CVEs
 before 0:2.504.2.1750857144-3.el9
0:2.504.2.1750857144-3.el9
jenkins-2-plugins
Red Hat:ocp_tools:4.16::el9
From an advisory covering 4 CVEs
 before 0:4.16.1750857315-1.el9
0:4.16.1750857315-1.el9
Show 20 moreShow less
Affected packages
PackageAffectedFixed
jenkins
Red Hat:ocp_tools:4.15::el8
From an advisory covering 4 CVEs
 before 0:2.504.2.1750856366-3.el8
0:2.504.2.1750856366-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.15::el8
From an advisory covering 4 CVEs
 before 0:4.15.1750856638-1.el8
0:4.15.1750856638-1.el8
jenkins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 4 CVEs
 before 0:2.504.2.1750932984-3.el8
0:2.504.2.1750932984-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.12::el8
From an advisory covering 4 CVEs
 before 0:4.12.1750933270-1.el8
0:4.12.1750933270-1.el8
jenkins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 4 CVEs
 before 0:2.504.2.1750916374-3.el8
0:2.504.2.1750916374-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.13::el8
From an advisory covering 4 CVEs
 before 0:4.13.1750916671-1.el8
0:4.13.1750916671-1.el8
jenkins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 4 CVEs
 before 0:2.504.2.1750903189-3.el8
0:2.504.2.1750903189-3.el8
jenkins-2-plugins
Red Hat:ocp_tools:4.14::el8
From an advisory covering 4 CVEs
 before 0:4.14.1750903529-1.el8
0:4.14.1750903529-1.el8
org.eclipse.jetty.http2:jetty-http2-common
Root:Maven
 before 12.0.13-aikido.7
12.0.13-aikido.712.0.3-aikido.712.0.13-aikido.812.0.13-aikido.912.0.16-aikido.412.0.3-aikido.812.0.13-aikido.1012.0.16-aikido.512.0.3-aikido.9
io.root.org.eclipse.jetty.http2:jetty-http2-common
Root:Maven
 before 12.0.3-root.io.3
12.0.3-root.io.312.0.13-root.io.612.0.16-root.io.212.0.3-root.io.412.0.3-root.io.512.0.3-root.io.612.0.13-root.io.712.0.3-root.io.712.0.16-root.io.312.0.13-root.io.812.0.13-root.io.912.0.16-root.io.412.0.3-root.io.812.0.13-root.io.1012.0.16-root.io.512.0.3-root.io.9
jetty
Ubuntu:14.04:LTS
 All versions, plus listed versions
6.1.26-1ubuntu16.1.26-1ubuntu1.16.1.26-1ubuntu1.2
 None known
jetty
Ubuntu:16.04:LTS
 All versions, plus listed versions
6.1.26-56.1.26-5ubuntu0.1
 None known
jetty9
Ubuntu:16.04:LTS
 All versions, plus listed versions
9.2.14-1
 None known
jetty9
Ubuntu:18.04:LTS
 All versions, plus listed versions
9.2.22-29.2.22-39.2.23-19.4.15-1~18.04.1ubuntu1
 None known
jetty9
Ubuntu:20.04:LTS
 All versions, plus listed versions
9.4.18-2build29.4.26-1
 None known
jetty9
Ubuntu:22.04:LTS
 All versions, plus listed versions
9.4.39-39.4.44-29.4.44-39.4.44-49.4.45-1
 None known
jetty9
Ubuntu:24.04:LTS
 All versions, plus listed versions
9.4.51-29.4.53-1
 None known
jetty9
Ubuntu:25.10
 All versions, plus listed versions
9.4.56-19.4.57-1
 None known
jetty9
Ubuntu:26.10
 All versions, plus listed versions
9.4.58-19.4.58-2
 None known
jetty9
Ubuntu:26.04:LTS
 All versions, plus listed versions
9.4.57-19.4.57-1.19.4.58-1
 None known

History

History
RecordedChangedSources
affected, facts
first indexedCVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2025-1948 is a high vulnerability (CVSS 7.5) in Eclipse Jetty, published May 8, 2025. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.78%, the 56th percentile. Fixed in org.eclipse.jetty.http2:jetty-http2-common 12.0.17.

References

Show 39 moreShow less
Pages All vulnerabilities Browse Docs Sources Guide Get API key
MoveEnter Open