Jetty WebSocket Opcode Leak Causing Heap Exhaustion
CVE-2026-19204 Published on September 7, 2026
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
Vulnerability Analysis
CVE-2026-19204 is exploitable with network access, and does not require authorization privileges or user interaction. This vulnerability is considered to have a low attack complexity. The potential impact of an exploit of this vulnerability is considered to have no impact on confidentiality and integrity and availability.
Weakness Types
Allocation of Resources Without Limits or Throttling
The software allocates a reusable resource or group of resources on behalf of an actor without imposing any restrictions on the size or number of resources that can be allocated, in violation of the intended security policy for that actor.
What is a Stack Exhaustion Vulnerability?
The product allocates memory based on an untrusted, large size value, but it does not ensure that the size is within expected limits, allowing arbitrary amounts of memory to be allocated.
CVE-2026-19204 has been classified to as a Stack Exhaustion vulnerability or weakness.
Products Associated with CVE-2026-19204
Want to know whenever a new CVE is published for Eclipse Jetty? stack.watch will email you.
Affected Versions
Eclipse Foundation Eclipse Jetty:- Version 12.1.0, <= 12.1.11 is affected.
- Version 12.0.0, <= 12.0.37 is affected.
- Version 11.0.0, <= 11.0.31 is affected.
- Version 10.0.0, <= 10.0.31 is affected.