Read the docs
TI-2025-01693 Aliases CVE-2025-1948GHSA-889j-63jv-qhr8

Eclipse Jetty HTTP clients can increase memory allocation

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Fixed

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00781 56th percentileScored 2026-11-07
Fix Fixed org.eclipse.jetty.http2:jetty-http2-common (Maven): 12.0.17Red Hat: 9 advisories

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationJetty12.0.0 – 12.0.16—No fix listedCNA
—org.eclipse.jetty.http2:jetty-http2-common (Maven)12.0.0 to before 12.0.1712.0.17Patch availableGHSA-889j-63jv-qhr8
  • Jetty VendorEclipse Foundation Affected 12.0.0 – 12.0.16 Fixed in — No fix listed CNA
  • org.eclipse.jetty.http2:jetty-http2-common (Maven) Vendor— Affected 12.0.0 to before 12.0.17 Fixed in 12.0.17 Patch available GHSA-889j-63jv-qhr8

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*12.0.0 to before 12.0.17VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 12.0.0 to before 12.0.17 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-889j-63jv-qhr8 org.eclipse.jetty.http2:jetty-http2-common (Maven) Fixed in 12.0.17 Advisory →

Red Hat 9 advisories

  • RHSA-2025:13274 Released 2025-08-06 · Red Hat rating Important
    Red Hat AMQ Broker 7.13.1 release and security update
    • Red Hat AMQ Broker 7.13.1
  • RHSA-2025:10120 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.14 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.14 jenkins-2-plugins-4.14.1750903529-1.el8, jenkins-2.504.2.1750903189-3.el8
  • RHSA-2025:10118 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.12 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.12 jenkins-2-plugins-4.12.1750933270-1.el8, jenkins-2.504.2.1750932984-3.el8
Show 6 more Red Hat advisories
  • RHSA-2025:10119 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.13 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.13 jenkins-2-plugins-4.13.1750916671-1.el8, jenkins-2.504.2.1750916374-3.el8
  • RHSA-2025:10104 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.15 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.15 jenkins-2-plugins-4.15.1750856638-1.el8, jenkins-2.504.2.1750856366-3.el8
  • RHSA-2025:10098 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.16 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.16 jenkins-2-plugins-4.16.1750857315-1.el9, jenkins-2.504.2.1750857144-3.el9
  • RHSA-2025:10097 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.17 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.17 jenkins-2-plugins-4.17.1750851950-1.el9, jenkins-2.504.2.1750851690-3.el9
  • RHSA-2025:10092 Released 2025-07-01 · Red Hat rating Important
    Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update
    • OpenShift Developer Tools and Services for OCP 4.18 jenkins-2-plugins-4.18.1750846854-1.el9, jenkins-2.504.2.1750846524-3.el9
  • RHSA-2025:7696 Released 2025-05-15 · Red Hat rating Important
    Red Hat Build of Apache Camel 4.10.3 for Spring Boot release, security update.
    • Red Hat build of Apache Camel 4.10.3 for Spring Boot

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and Services for OCP 4.12Fixed RHSA-2025:10118
OpenShift Developer Tools and Services for OCP 4.13Fixed RHSA-2025:10119
OpenShift Developer Tools and Services for OCP 4.14Fixed RHSA-2025:10120
OpenShift Developer Tools and Services for OCP 4.15Fixed RHSA-2025:10104
OpenShift Developer Tools and Services for OCP 4.16Fixed RHSA-2025:10098
OpenShift Developer Tools and Services for OCP 4.17Fixed RHSA-2025:10097
OpenShift Developer Tools and Services for OCP 4.18Fixed RHSA-2025:10092
Red Hat AMQ Broker 7.13.1Fixed RHSA-2025:13274
Red Hat build of Apache Camel 4.10.3 for Spring BootFixed RHSA-2025:7696

Timeline

  1. 2026-10-02 Threatist record created from CVE-2025-1948
  2. 2026-10-03 Alias added: GHSA-889j-63jv-qhr8

References

Advisory 2

Other 4

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences