OutOfMemoryError in Eclipse Jetty due to Improper HTTP/2 Header List Size Validation

CVE-2025-1948

What is CVE-2025-1948?

In versions 12.0.0 through 12.0.16 of Eclipse Jetty, a flaw occurs when the HTTP/2 client sends an excessively large SETTINGS_MAX_HEADER_LIST_SIZE. Due to a lack of validation, the Jetty HTTP/2 server attempts to allocate a ByteBuffer of the specified size for encoding HTTP responses. This can potentially lead to an OutOfMemoryError or cause the JVM process to terminate unexpectedly.

References