WebSocket Exploit in Jetty Server by Eclipse Foundation
CVE-2026-19204

8.7HIGH

Key Information:

Vendor

Eclipse Foundation

Status
Eclipse Jetty
Vendor
CVE Published:
7 September 2026

What is CVE-2026-19204?

A vulnerability exists in Jetty's handling of WebSocket frames with unknown opcodes. When auto-fragmentation is enabled, these unknown opcodes can bypass normal frame size restrictions, leading to large memory allocation attempts. This could overwhelm the Java Virtual Machine (JVM) heap, potentially resulting in service outages or degraded performance.

Affected Version(s)

Eclipse Jetty 12.1.0 <= 12.1.11

Eclipse Jetty 12.0.0 <= 12.0.37

Eclipse Jetty 11.0.0 <= 11.0.31

References

https://github.com/jetty/jetty.project/security/advisorie...

CVSS V4

Score:
8.7
Severity:
HIGH
Confidentiality:
None
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Arthur Chan
David Korczynski
Adam Korcz
.