VULNERABILITY INTELLIGENCE
CVE-2026-19204
EPSS probability0.45%
CISA KEVNot currently listed
Published2026-09-07
Last modified2026-09-08
Description
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
Weakness classification
- emo@eclipse.org: CWE-770