CVE-2026-19204
Received Received - Intake

Memory Exhaustion in Jetty WebSocket Due to Unknown Opcode

Publication date: 2026-09-07

Last updated on: 2026-09-07

Assigner: Eclipse Foundation

Description
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

CVSS Scores

EPSS Scores

Probability:
Percentile:

Meta Information

Published
2026-09-07
Last Modified
2026-09-07
Generated
2026-09-07
AI Q&A
2026-09-07
EPSS Evaluated
N/A
NVD
CVE-2026-19204
EUVD
EUVD-2026-72335

Affected Vendors & Products

Showing 1 associated CPE
Vendor Product Version / Range
eclipse jetty *

Helpful Resources

Exploitability

CWE
CWE Icon
KEV
KEV Icon
CWE ID Description
CWE-789 The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CWE-770 The product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.

Attack-Flow Graph

AI Quick Actions

Instant insights powered by AI
Executive Summary

This vulnerability involves a client sending a WebSocket frame with an unknown opcode and an extremely large declared payload length. Jetty attempts to allocate memory for this payload, which can exhaust the JVM heap when auto-fragmentation is enabled. The issue occurs because unknown opcodes bypass normal frame size checks, leading to excessive memory allocation before validation.

Detection Guidance

Detecting this vulnerability requires monitoring for unusual WebSocket traffic patterns or memory exhaustion events. Check Jetty server logs for WebSocket-related errors or large memory allocations. Use system monitoring tools like top, htop, or jstat to observe JVM heap usage spikes during WebSocket operations.

Impact Analysis

This vulnerability can cause a denial-of-service by crashing the application due to memory exhaustion. If the JVM heap is depleted, the system may become unresponsive or terminate unexpectedly, disrupting services relying on Jetty for WebSocket communication.

Compliance Impact

This vulnerability could lead to denial-of-service conditions by exhausting JVM heap memory, potentially disrupting services handling sensitive data. For GDPR, this may impact availability of personal data processing systems, while for HIPAA, it could affect the integrity and availability of protected health information systems.

Mitigation Strategies

Disable auto-fragmentation in Jetty WebSocket configuration. Set explicit maximum frame size limits in WebSocket server settings. Update Jetty to the latest patched version if available. Monitor and restrict WebSocket connections from untrusted sources.

Chat Assistant

Ask questions about this CVE
Hi! I’m here to help you understand CVE-2026-19204. Ask me anything about the vulnerability, its impact, or mitigation strategies.
0/70

EPSS Chart