CVE-2026-19204: Eclipse Jetty vulnerability
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.
This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Configuration
Disable WebSocket auto-fragmentation to prevent unknown opcode handling from bypassing normal maximum frame size checks and triggering large payload allocations before opcode validation.
Jetty WebSocket (auto-fragmentation) auto-fragmentation = disabled
Event History
Frequently Asked Questions
Which Jetty deployments are exposed?
Deployments with WebSocket auto-fragmentation enabled are affected by this condition. The issue involves handling of WebSocket frames with unknown opcodes.
What does an attacker need to do to trigger the memory-exhaustion condition?
An attacker needs to be able to act as a WebSocket client and send a frame using an unknown opcode with a very large declared payload length. Jetty may attempt the payload allocation before validating the opcode, potentially exhausting the JVM heap.