CVE-2025-1948: Eclipse Jetty HTTP clients can increase memory allocation
Original Report
In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGSMAXHEADERLISTSIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Impact Remote peers can cause the JVM to crash or continuously report OOM.
Patches 12.0.17
Workarounds No workarounds.
References https://github.com/jetty/jetty.project/issues/12690
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
maven/org.eclipse.jetty.http2:jetty-http2-commonto a version that resolves this vulnerability.Fixed in 12.0.17 - Upgrade
Upgrade
Eclipse Jettyto a version that resolves this vulnerability.Fixed in 12.0.17Patch CVE-2025-1948 & CVE-2024-13009
Event History
Frequently Asked Questions
What is the severity of CVE-2025-1948?
CVE-2025-1948 has a high severity rating due to the potential for denial of service caused by unvalidated HTTP/2 header sizes.
How do I fix CVE-2025-1948?
To fix CVE-2025-1948, update Eclipse Jetty to version 12.0.17 or later where the vulnerability is patched.
What versions of Eclipse Jetty are affected by CVE-2025-1948?
Eclipse Jetty versions from 12.0.0 to 12.0.16 are affected by CVE-2025-1948.
What type of attack is possible with CVE-2025-1948?
CVE-2025-1948 allows an attacker to cause denial of service by exploiting the error in handling large header list sizes.
Is there a known exploit for CVE-2025-1948?
As of now, there are no publicly disclosed active exploits for CVE-2025-1948, but the vulnerability poses a significant risk if left unpatched.