Threat Intelligence Database

CVE-2026-19204 is a high-severity vulnerability in Eclipse Jetty where a client can send a WebSocket frame with an unknown opcode and a very large declared payload length. This causes Jetty to allocate a large amount of memory, potentially exhausting the JVM heap. The issue arises when auto-fragmentation is enabled, as unknown opcodes bypass normal frame size checks and payload allocation happens before opcode validation.

In Eclipse Jetty, the class JASPIAuthenticator initiates the authentication checks, which set two ThreadLocal variable. Upon returning from the initial checks, there are conditions that cause an early return from the JASPIAuthenticator code without clearing those ThreadLocals. A subsequent request using the same thread inherits the ThreadLocal values, leading to a broken access control and privilege escalation.

There exists a security vulnerability in Jetty's ThreadLimitHandler.getRemote() which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory.

MediumVulnerabilityGermanyFranceUnited Kingdom+3#cve#cve-2024-8184#cwe-400

Jetty PushSessionCacheFilter can be exploited by unauthenticated users to launch remote DoS attacks by exhausting the server’s memory.

LowVulnerabilityGermanyFranceUnited Kingdom+4#cve#cve-2024-6762#cwe-400

There exists a security vulnerability in Jetty's DosFilter which can be exploited by unauthorized users to cause remote denial-of-service (DoS) attack on the server using DosFilter. By repeatedly sending crafted requests, attackers can trigger OutofMemory errors and exhaust the server's memory finally.

MediumVulnerabilityGermanyFranceUnited Kingdom+5#cve#cve-2024-9823#cwe-400