UpHeron
All vulnerabilities

Servers and applications

CVE-2025-1948

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process…

Severity
High 7.5
Published
8 May 2025
Last changed
17 Jun 2026
Added to UpHeron
1 Nov 2026
Fixed in
12.0.17
Sources
NVD

Affected software

SoftwareAffected versions
Eclipse JettyServers and applications · cpe:a:eclipse:jetty
  • From 12.0.0 before 12.0.17

References

  • NVD https://nvd.nist.gov/vuln/detail/CVE-2025-1948
  • CVE.org https://www.cve.org/CVERecord?id=CVE-2025-1948