{"id":"CVE-2025-1948","aliases":["DEBIAN-CVE-2025-1948","EUVD-2025-14031","GHSA-889j-63jv-qhr8","RHSA-2025:10092","RHSA-2025:10097","RHSA-2025:10098","RHSA-2025:10104","RHSA-2025:10118","RHSA-2025:10119","RHSA-2025:10120","ROOT-APP-MAVEN-CVE-2025-1948","UBUNTU-CVE-2025-1948"],"status":"published","title":"Eclipse Jetty HTTP clients can increase memory allocation","description":"In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.\nThe Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00794,"percentile":0.56665,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400"],"published":"2025-05-08T17:48:40Z","modified":"2026-10-28T02:30:28Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","fixed_in":["12.0.17"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:13","package":"jetty12","fixed_in":["12.0.17-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"jetty12","fixed_in":["12.0.17-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","fixed_in":["12.0.13-aikido.7","12.0.3-aikido.7","12.0.13-aikido.8","12.0.13-aikido.9","12.0.16-aikido.4","12.0.3-aikido.8","12.0.13-aikido.10","12.0.16-aikido.5","12.0.3-aikido.9"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty.http2:jetty-http2-common","fixed_in":["12.0.3-root.io.3","12.0.13-root.io.6","12.0.16-root.io.2","12.0.3-root.io.4","12.0.3-root.io.5","12.0.3-root.io.6","12.0.13-root.io.7","12.0.3-root.io.7","12.0.16-root.io.3","12.0.13-root.io.8","12.0.13-root.io.9","12.0.16-root.io.4","12.0.3-root.io.8","12.0.13-root.io.10","12.0.16-root.io.5","12.0.3-root.io.9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.16"},{"fixed":"12.0.17"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-1"}]}]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.17"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.2","12.0.3","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.18::el9","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.504.2.1750846524-3.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.18::el9","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.18.1750846854-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.17::el9","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.504.2.1750851690-3.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.17::el9","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.17.1750851950-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.16::el9","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.504.2.1750857144-3.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.16::el9","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.16.1750857315-1.el9"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.504.2.1750856366-3.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.15::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.15.1750856638-1.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.504.2.1750932984-3.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.12::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.12.1750933270-1.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.504.2.1750916374-3.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.13::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.13.1750916671-1.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.504.2.1750903189-3.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:ocp_tools:4.14::el8","package":"jenkins-2-plugins","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.14.1750903529-1.el8"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Maven","package":"org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.13-aikido.7"},{"fixed":"12.0.3-aikido.7"},{"fixed":"12.0.13-aikido.8"},{"fixed":"12.0.13-aikido.9"},{"fixed":"12.0.16-aikido.4"},{"fixed":"12.0.3-aikido.8"},{"fixed":"12.0.13-aikido.10"},{"fixed":"12.0.16-aikido.5"},{"fixed":"12.0.3-aikido.9"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty.http2:jetty-http2-common","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.3-root.io.3"},{"fixed":"12.0.13-root.io.6"},{"fixed":"12.0.16-root.io.2"},{"fixed":"12.0.3-root.io.4"},{"fixed":"12.0.3-root.io.5"},{"fixed":"12.0.3-root.io.6"},{"fixed":"12.0.13-root.io.7"},{"fixed":"12.0.3-root.io.7"},{"fixed":"12.0.16-root.io.3"},{"fixed":"12.0.13-root.io.8"},{"fixed":"12.0.13-root.io.9"},{"fixed":"12.0.16-root.io.4"},{"fixed":"12.0.3-root.io.8"},{"fixed":"12.0.13-root.io.10"},{"fixed":"12.0.16-root.io.5"},{"fixed":"12.0.3-root.io.9"}]}]},{"source":"osv","ecosystem":"Ubuntu:14.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-1ubuntu1","6.1.26-1ubuntu1.1","6.1.26-1ubuntu1.2"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["6.1.26-5","6.1.26-5ubuntu0.1"]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.56-1","9.4.57-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"jetty"}],"references":[{"url":"https://gitlab.eclipse.org/security/cve-assignement/-/issues/56","tags":["Issue Tracking","report","web","article"]},{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-1948","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project/issues/12690","tags":["web","report"]},{"url":"https://github.com/jetty/jetty.project/commit/c8c2515936ef968dc8a3cecd9e79d1e69291e4bb","tags":["web"]},{"url":"https://github.com/advisories/GHSA-889j-63jv-qhr8"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2025/1xxx/CVE-2025-1948.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2025-1948","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10092","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2344073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2353507","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2365137","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2374804","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10092.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-57699","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-57699","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-57699","tags":["advisory"]},{"url":"https://github.com/TurtleLiu/Vul_PoC/tree/main/CVE-2024-57699","tags":["article"]},{"url":"https://nvd.nist.gov/vuln/detail/cve-2023-1370","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-1948","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-1948","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-22228","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-22228","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-22228","tags":["advisory"]},{"url":"https://spring.io/security/cve-2025-22228","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2025-52999","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2025-52999","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2025-52999","tags":["advisory"]},{"url":"https://github.com/FasterXML/jackson-core/pull/943","tags":["article"]},{"url":"https://github.com/FasterXML/jackson-core/security/advisories/GHSA-h46c-h94j-95f3","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10097","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10097.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10098","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10098.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10104","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10104.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10118","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10118.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10119","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10119.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2025:10120","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2025/rhsa-2025_10120.json","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2025-1948","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2025-1948","title":"Eclipse Jetty HTTP clients can increase memory allocation","description":"In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.\nThe Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.","status":"published","published":"2025-05-08T17:48:40.831Z","modified":"2025-05-08T18:31:44.196Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:32:49.824855Z"}],"euvd":[{"id":"EUVD-2025-14031","description":"In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.\nThe Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.","status":"published","published":"2025-05-08T17:48:40Z","modified":"2025-05-08T18:31:44Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T20:32:51.637681Z"}],"ghsa":[{"id":"GHSA-889j-63jv-qhr8","title":"Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit","description":"### Original Report\n\nIn Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.\n\n### Impact\nRemote peers can cause the JVM to crash or continuously report OOM.\n\n### Patches\n12.0.17\n\n### Workarounds\nNo workarounds.\n\n### References\nhttps://github.com/jetty/jetty.project/issues/12690","status":"published","published":"2025-05-08T19:28:45Z","modified":"2025-05-08T19:28:48Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:38:43.172412Z"}],"nvd":[{"id":"CVE-2025-1948","description":"In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.\nThe Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.","status":"published","published":"2025-05-08T18:15:41.99Z","modified":"2026-06-17T08:40:24.42Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T14:11:06.085152Z"}],"osv":[{"id":"CVE-2025-1948","title":"Eclipse Jetty HTTP clients can increase memory allocation","description":"In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE.\nThe Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.","status":"published","published":"2025-05-08T17:48:40.831Z","modified":"2026-10-28T02:30:28.167724541Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:44:46.665428Z"},{"id":"DEBIAN-CVE-2025-1948","description":"In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.","status":"published","published":"2025-05-08T18:15:41.99Z","modified":"2026-09-01T20:05:41.611373357Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:45.102284Z"},{"id":"GHSA-889j-63jv-qhr8","title":"Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit","description":"### Original Report\n\nIn Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.\n\n### Impact\nRemote peers can cause the JVM to crash or continuously report OOM.\n\n### Patches\n12.0.17\n\n### Workarounds\nNo workarounds.\n\n### References\nhttps://github.com/jetty/jetty.project/issues/12690","status":"published","published":"2025-05-08T19:28:45Z","modified":"2026-09-10T03:50:24.419575426Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400"],"updated_at":"2026-11-02T15:46:42.077781Z"},{"id":"RHSA-2025:10092","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update","status":"published","published":"2025-07-02T10:03:25Z","modified":"2026-09-15T10:05:25Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10097","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update","status":"published","published":"2025-07-02T10:03:28Z","modified":"2026-09-15T10:05:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10098","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update","status":"published","published":"2025-07-02T10:03:29Z","modified":"2026-09-15T10:05:26Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10104","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update","status":"published","published":"2025-07-02T10:03:31Z","modified":"2026-09-15T10:05:27Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10118","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update","status":"published","published":"2025-07-02T10:03:33Z","modified":"2026-09-15T10:05:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10119","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update","status":"published","published":"2025-07-02T10:03:34Z","modified":"2026-09-15T10:05:28Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"RHSA-2025:10120","title":"Red Hat Security Advisory: Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update","status":"published","published":"2025-07-02T10:03:35Z","modified":"2026-09-15T10:05:29Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:15.137262Z"},{"id":"UBUNTU-CVE-2025-1948","description":"In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.","status":"published","published":"2025-05-08T18:15:00Z","modified":"2026-10-17T12:57:01.599660858Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:55:20.144818Z"},{"id":"ROOT-APP-MAVEN-CVE-2025-1948","title":"CVE-2025-1948 in org.eclipse.jetty.http2:jetty-http2-common - Patched by Root","description":"Root has patched CVE-2025-1948 in the org.eclipse.jetty.http2:jetty-http2-common package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-08-14T12:22:49Z","modified":"2026-08-14T14:45:11.571641878Z","updated_at":"2026-11-02T15:53:27.066589Z"}]}}