Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

nvd логотип

CVE-2025-1948

Опубликовано: 08 мая 2025
Источник: nvd
CVSS3: 7.5
EPSS Низкий

Описание

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

Уязвимые конфигурации

Конфигурация 1
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*
Версия от 12.0.0 (включая) до 12.0.17 (исключая)

EPSS

Процентиль: 26%
0.00089
Низкий

7.5 High

CVSS3

Дефекты

CWE-400

Связанные уязвимости

CVSS3: 7.5
ubuntu
8 месяцев назад

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

CVSS3: 7.5
redhat
8 месяцев назад

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

CVSS3: 7.5
debian
8 месяцев назад

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client ...

CVSS3: 7.5
github
8 месяцев назад

Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequently the JVM to exit

EPSS

Процентиль: 26%
0.00089
Низкий

7.5 High

CVSS3

Дефекты

CWE-400