Denial of Service Vulnerability in Eclipse Jetty Server

CVE-2018-12545

What is CVE-2018-12545?

Eclipse Jetty versions 9.3.x and 9.4.x are susceptible to Denial of Service attacks when a remote client sends excessively large SETTINGS frames or multiple small SETTINGS frames. The vulnerability arises from the server's increased CPU and memory demand to accommodate these frame modifications, potentially leading to resource exhaustion and service unavailability.

References