UpHeron
All vulnerabilities

Servers and applications

CVE-2018-12545

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

Severity
High 7.5
Published
27 Mar 2019
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Exploit chance
5.1% in the next 30 daysHigher than 92% of CVEs. EPSS by FIRST, 10 Nov 2026
Sources
NVD

Affected software

SoftwareAffected versions
Eclipse JettyServers and applications · cpe:a:eclipse:jetty
  • Version 9.4.12-rc2
  • Version 9.4.12-rc1
  • Version 9.4.12-rc0
  • Version 9.4.11-20180605
All 84 release lines
  • Version 9.3.0-rc0
  • Version 9.3.0-rc1
  • Version 9.3.0-20150601
  • Version 9.3.0-20150608
  • Version 9.3.0-20150612
  • Version 9.3.0-maintenance0
  • Version 9.3.0-maintenance1
  • Version 9.3.0-maintenance2
  • Version 9.3.1-20150714
  • Version 9.3.2-20150730
  • Version 9.3.3-20150825
  • Version 9.3.3-20150827
  • Version 9.3.4-rc0
  • Version 9.3.4-rc1
  • Version 9.3.4-20151005
  • Version 9.3.4-20151007
  • Version 9.3.5-20151012
  • Version 9.3.6-20151106
  • Version 9.3.7-rc0
  • Version 9.3.7-rc1
  • Version 9.3.7-20160115
  • Version 9.3.8-rc0
  • Version 9.3.8-20160311
  • Version 9.3.8-20160314
  • Version 9.3.9-20160517
  • Version 9.3.9-maintenance_0
  • Version 9.3.9-maintenance_1
  • Version 9.3.10-20160621
  • Version 9.3.10-maintenance_0
  • Version 9.3.11-20160721
  • Version 9.3.11-maintenance_0
  • Version 9.3.12-20160915
  • Version 9.3.13-20161014
  • Version 9.3.13-maintenance_0
  • Version 9.3.14-20161028
  • Version 9.3.15-20161220
  • Version 9.3.16-20170119
  • Version 9.3.16-20170120
  • Version 9.3.17-rc0
  • Version 9.3.17-20170317
  • Version 9.3.18-20170406
  • Version 9.3.19-20170502
  • Version 9.3.20-20170531
  • Version 9.3.21-rc0
  • Version 9.3.21-20170918
  • Version 9.3.21-maintenance_0
  • Version 9.3.22-20171030
  • Version 9.3.23-20180228
  • Version 9.3.24-20180605
  • Version 9.4.0-rc0
  • Version 9.4.0-rc1
  • Version 9.4.0-rc2
  • Version 9.4.0-rc3
  • Version 9.4.0-20161207
  • Version 9.4.0-20161208
  • Version 9.4.0-20180619
  • Version 9.4.0-maintenance_0
  • Version 9.4.0-maintenance_1
  • Version 9.4.1-20170120
  • Version 9.4.1-20180619
  • Version 9.4.2-20170220
  • Version 9.4.2-20180619
  • Version 9.4.3-20170317
  • Version 9.4.3-20180619
  • Version 9.4.4-20170410
  • Version 9.4.4-20170414
  • Version 9.4.4-20180619
  • Version 9.4.5-20170502
  • Version 9.4.5-20180619
  • Version 9.4.6-20170531
  • Version 9.4.6-20180619
  • Version 9.4.7-rc0
  • Version 9.4.7-20170914
  • Version 9.4.7-20180619
  • Version 9.4.8-20171121
  • Version 9.4.8-20180619
  • Version 9.4.9-20180320
  • Version 9.4.10-rc0
  • Version 9.4.10-rc1
  • Version 9.4.10-20180503
  • Version 9.4.11-20180605
  • Version 9.4.12-rc0
  • Version 9.4.12-rc1
  • Version 9.4.12-rc2

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2018-12545
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2018-12545