A vulnerability in Eclipse Jetty's PushSessionCacheFilter allows unauthenticated remote attackers to cause denial of service (DoS) by exhausting server memory. This issue affects versions prior to 10.0.18, 11.0.18, and 12.0.4. The vulnerability arises from the intrinsic session usage design of the PushCacheFilter. Mitigations include avoiding use of PushCacheFilter, reducing idle timeout on unauthenticated sessions, or configuring session passivation to offload sessions from memory. Official patches are available in the fixed versions.