{"id":"CVE-2026-19204","title":"A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.\n\n\n\n\nThis occurs when auto-fragmentation is enab…","summary":"A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.\n\n\n\n\nThis occurs when auto-fragmentation is enab…","severity":"high","cvss":8.7,"cvssVector":"CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N","cwe":["CWE-770","CWE-789","CWE-1284"],"vendor":"Eclipse Foundation","product":"Eclipse Jetty","affected":["eclipse_jetty >= 12.1.0 <= 12.1.11","eclipse_jetty >= 12.0.0 <= 12.0.37","eclipse_jetty >= 11.0.0 <= 11.0.31","eclipse_jetty >= 10.0.0 <= 10.0.31"],"published":"2026-09-07","updated":"2026-09-08","sourceUpdated":"2026-09-08T16:18:06.627","source":"NVD","sourceUrl":"https://nvd.nist.gov/vuln/detail/CVE-2026-19204","references":[{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g","label":"emo@eclipse.org"},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19204.json"},{"url":"https://access.redhat.com/security/cve/CVE-2026-19204"},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2529344"},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-19204"},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19204"}],"tags":["nvd","cve.org","csaf","vex","red-hat"],"ssvc":{"exploitation":"none","automatable":"yes","technicalImpact":"partial","timestamp":"2026-09-08T15:06:34.664874Z"},"cvssSource":"cna","epss":0.0031,"epssPercentile":0.21182,"ingestedAt":"2026-09-08T15:33:26.976Z","scores":{"cna":8.7,"vendor":7.5},"slug":"CVE-2026-19204","body":"## Overview\n\nA client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.\n\n\n\n\nThis occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.\n\n## Remediation\n\nRefer to the linked advisories for vendor-supplied fixes and affected version ranges.\n\n## Vendor advisories\n\n- **Red Hat VEX** · Important · affected: Red Hat Enterprise Linux 9, Red Hat Fuse 7, Red Hat Satellite 6 · no fix planned: Red Hat Enterprise Linux 9 · updated 2026-09-21 · [vex](https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-19204.json)","depth":"twilight","depthScore":48,"depthScoreParts":{"impact":47.8,"likelihood":0.1,"exploitation":0,"ransomware":0},"changes":[]}