CVE-2025-1948
Fixed in a distro release EPSS <1%CVSS 7.5
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Products: Eclipse Foundation Jetty
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| Maven | org.eclipse.jetty.http2:jetty-http2-common | 12.0.17 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Chainguard | neo4j-5.26 | 5.26.6-r1 |
| Chainguard | neo4j-5.26-docker-publish | 5.26.6-r1 |
| Debian 13 | jetty12 | 12.0.17-1 |
| Debian 14 | jetty12 | 12.0.17-1 |
| Red Hat ocp tools 4.12 | jenkins | 0:2.504.2.1750932984-3.el8 |
| Red Hat ocp tools 4.12 | jenkins-2-plugins | 0:4.12.1750933270-1.el8 |
| Red Hat ocp tools 4.13 | jenkins | 0:2.504.2.1750916374-3.el8 |
| Red Hat ocp tools 4.13 | jenkins-2-plugins | 0:4.13.1750916671-1.el8 |
| Red Hat ocp tools 4.14 | jenkins | 0:2.504.2.1750903189-3.el8 |
| Red Hat ocp tools 4.14 | jenkins-2-plugins | 0:4.14.1750903529-1.el8 |
| Red Hat ocp tools 4.15 | jenkins | 0:2.504.2.1750856366-3.el8 |
| Red Hat ocp tools 4.15 | jenkins-2-plugins | 0:4.15.1750856638-1.el8 |
| Red Hat ocp tools 4.16 | jenkins | 0:2.504.2.1750857144-3.el9 |
| Red Hat ocp tools 4.16 | jenkins-2-plugins | 0:4.16.1750857315-1.el9 |
| Red Hat ocp tools 4.17 | jenkins | 0:2.504.2.1750851690-3.el9 |
| Red Hat ocp tools 4.17 | jenkins-2-plugins | 0:4.17.1750851950-1.el9 |
| Red Hat ocp tools 4.18 | jenkins | 0:2.504.2.1750846524-3.el9 |
| Red Hat ocp tools 4.18 | jenkins-2-plugins | 0:4.18.1750846854-1.el9 |
| Ubuntu 14.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty | no fix |
| Ubuntu 16.04 LTS | jetty9 | no fix |
| Ubuntu 18.04 LTS | jetty9 | no fix |
| Ubuntu 20.04 LTS | jetty9 | no fix |
| Ubuntu 22.04 LTS | jetty9 | no fix |
| Ubuntu 24.04 LTS | jetty9 | no fix |
| Ubuntu 25.10 | jetty9 | no fix |
| Ubuntu 26.04 LTS | jetty9 | no fix |
| Ubuntu 26.10 | jetty9 | no fix |