CVE-2026-19204
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust t…
Published: 2026-09-07 · CVSS: 8.7 · CVSS 4.0
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
Source: CVE Program · Revision 8b16575c39f1e1810c5e863010da073d2d3285e7