CVE-2026-19204

A client may send a WebSocket frame with an unknown opcode and a very large declared payload...

8.7 HighFix available

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.

This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Attack profile

How easy it is to exploit

Attack vector: Network
Complexity: Low
Privileges needed: None
User interaction: None

What an attacker can affect

Confidentiality: None
Integrity: None
Availability: High

Exploit likelihood

0.45%Up 0.2 points since Sep 8, 2026

What each source reports

CVE List Score used 8.7

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.

This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Record: CVE-2026-19204
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-770, CWE-789
Updated: 2026-11-02

EUVDEUVD-2026-72335 8.7

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.

This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Record: EUVD-2026-72335
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

GitHub AdvisoriesGHSA-w753-5ffq-99wr 8.7

A client may send a WebSocket frame with an unknown opcode and a very large declared payload...

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.

This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Record: GHSA-w753-5ffq-99wr
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-770
Updated: 2026-11-02

NVD 8.7

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.

This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Record: CVE-2026-19204
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Weakness: CWE-770, CWE-789
Updated: 2026-11-02

OSV 8.7

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.

This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Record: CVE-2026-19204
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Weakness: CWE-770, CWE-789
Updated: 2026-11-02

OSVDEBIAN-CVE-2026-19204 8.7

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Record: DEBIAN-CVE-2026-19204
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Updated: 2026-11-04

OSVUBUNTU-CVE-2026-19204 8.7

Record: UBUNTU-CVE-2026-19204
CVSS 4.0: 8.7 HighCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Updated: 2026-11-02

OSVCLSA-2026-1787893054 No score

TuxCare security update for 123 packages (3 CVEs)

TuxCare rebuilt 123 packages to address 3 CVEs. Fixed in 10.0.32.tuxcare0001.

Record: CLSA-2026-1787893054
Updated: 2026-11-02

OSVCLSA-2026-1789219285 No score

TuxCare security update for 123 packages (4 CVEs)

TuxCare rebuilt 123 packages to address 4 CVEs. Fixed in 11.0.32.tuxcare0001.

Record: CLSA-2026-1789219285
Updated: 2026-11-02

Affected products

eclipse foundation jetty

Affected packages

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty.demos:demo-async-rest-jar` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-webapp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-container-initializer` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-jaas-webapp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-jetty-webapp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-jndi-webapp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-jsp-webapp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-mock-resources` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001

Show 201 moreShow less

Affected packages
Package	Affected	Fixed
`org.eclipse.jetty.demos:demo-proxy-webapp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-simple-webapp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-spec` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-spec-webapp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-web-fragment` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demos-jetty-embedded` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demos-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.documentation:code-examples` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.documentation:documentation-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.documentation:jetty` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.gcloud:gcloud-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.gcloud:jetty-gcloud-session-manager` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-common` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-hpack` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-http-client-transport` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-common` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-http-client-transport` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-qpack` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.memcached:jetty-memcached-sessions` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.memcached:memcached-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-httpservice` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-alpn` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-jsp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-warurl` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-project` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.osgi:test-jetty-osgi` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-common` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-common` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-foreign-incubator` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-jna` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-common` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-common` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-javax-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-api` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-common` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-servlet` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:apache-jsp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:apache-jstl` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-common` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-embedded` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-embedded-query` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-remote` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-remote-query` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-java-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-java-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-parent` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-annotations` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-ant` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-bom` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-cdi` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-deploy` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-hazelcast` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-home` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-http` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-http-spi` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-io` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-jaas` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-jaspi` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-jmx` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-jndi` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-jspc-maven-plugin` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-keystore` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-maven-plugin` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-nosql` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-openid` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-p2` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-plus` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-project` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-proxy` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-quickstart` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-rewrite` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-runner` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-security` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-servlet` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-servlets` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-slf4j-impl` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-start` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-unixdomain-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-client` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-common` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-unixsocket-server` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-util` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-util-ajax` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-webapp` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty:jetty-xml` TuxCare:Maven From an advisory covering 3 CVEs	10.0.32 up to 10.0.32.tuxcare0001	10.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-jar` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-server` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-async-rest-webapp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-container-initializer` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-jaas-webapp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-jetty-webapp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-jndi-webapp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-jsp-webapp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-mock-resources` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-proxy-webapp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-simple-webapp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-spec` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-spec-webapp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demo-web-fragment` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demos-jetty-embedded` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.demos:demos-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.documentation:code-examples` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.documentation:documentation-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.documentation:jetty` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-client` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.fcgi:fcgi-server` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.gcloud:gcloud-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.gcloud:jetty-gcloud-session-manager` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-client` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-common` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-hpack` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-http-client-transport` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http2:http2-server` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-client` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-common` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-http-client-transport` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-qpack` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.http3:http3-server` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.memcached:jetty-memcached-sessions` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.memcached:memcached-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-httpservice` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-alpn` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-jsp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-boot-warurl` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.osgi:jetty-osgi-project` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.osgi:test-jetty-osgi` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-client` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-common` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-common` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-foreign-incubator` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-quiche-jna` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.quic:quic-server` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-client` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-common` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-core-server` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-client` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-common` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jakarta-server` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-api` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-client` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-common` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-jetty-server` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty.websocket:websocket-servlet` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:apache-jsp` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:glassfish-jstl` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-common` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-embedded` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-embedded-query` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-parent` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-remote` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:infinispan-remote-query` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-client` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-client` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`org.eclipse.jetty:jetty-alpn-conscrypt-server` TuxCare:Maven From an advisory covering 4 CVEs	11.0.32 up to 11.0.32.tuxcare0001	11.0.32.tuxcare0001
`jetty12` Debian:13	All versions, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-2 Show 4 moreShow less 12.0.33-112.0.39-112.0.40-112.0.40-2	None known
`jetty12` Debian:14	before 12.0.39-1, plus listed versions 12.0.17-312.0.17-3.112.0.17-3.1~deb13u112.0.32-112.0.32-212.0.33-1	12.0.39-1
`jetty9` Ubuntu:16.04:LTS	All versions, plus listed versions 9.2.14-1	None known
`jetty9` Ubuntu:18.04:LTS	All versions, plus listed versions 9.2.22-29.2.22-39.2.23-19.4.15-1~18.04.1ubuntu1	None known
`jetty9` Ubuntu:20.04:LTS	All versions, plus listed versions 9.4.18-2build29.4.26-1	None known
`jetty9` Ubuntu:22.04:LTS	All versions, plus listed versions 9.4.39-39.4.44-29.4.44-39.4.44-49.4.45-1	None known
`jetty9` Ubuntu:24.04:LTS	All versions, plus listed versions 9.4.51-29.4.53-1	None known
`jetty12` Ubuntu:26.10	All versions, plus listed versions 12.0.32-1	None known
`jetty9` Ubuntu:26.10	All versions, plus listed versions 9.4.58-19.4.58-2	None known
`jetty12` Ubuntu:26.04:LTS	All versions, plus listed versions 12.0.17-3.112.0.32-1	None known
`jetty9` Ubuntu:26.04:LTS	All versions, plus listed versions 9.4.57-19.4.57-1.19.4.58-1	None known

History

History
Recorded	Changed	Sources
Nov 6, 2026	affected
Nov 4, 2026	affected, facts	OSV
Nov 2, 2026	first indexed	CVE List, EUVD, GitHub Advisories, NVD, OSV

Dates are when Every CVE recorded each change. Upstream dates may differ.

In short

CVE-2026-19204 is a high vulnerability (CVSS 8.7) in Eclipse Foundation Jetty, published August 28, 2026. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.45%, the 39th percentile. Fixed in jetty12 12.0.39-1.

References

This page doesn't list everything

Also not on the record: 46 package claims. ID and package lookups still check them.