PT-2025-20402 · Eclipse · Eclipse Jetty

Bjorncs · Published 2025-05-08 · Updated 2025-05-10 · CVE-2025-1948

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Name of the Vulnerable Software and Affected Versions Eclipse Jetty versions 12.0.0 through 12.0.16

Description The issue arises when an HTTP/2 client specifies a very large value for the HTTP/2 settings parameter SETTINGS MAX HEADER LIST SIZE. The Jetty HTTP/2 server fails to validate this setting and attempts to allocate a ByteBuffer of the specified capacity to encode HTTP responses. This can likely result in an OutOfMemoryError being thrown or even cause the JVM process to exit.

Recommendations For Eclipse Jetty versions 12.0.0 through 12.0.16, consider validating the SETTINGS MAX HEADER LIST SIZE parameter to prevent excessively large values from being set, which can help mitigate the risk of OutOfMemoryError or JVM process exit. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Resource Exhaustion

Weakness Enumeration

CWE-400

Related Identifiers

CVE-2025-1948

GHSA-889J-63JV-QHR8

RHSA-2025:10092

RHSA-2025:10097

RHSA-2025:10098

RHSA-2025:10104

RHSA-2025:10118

RHSA-2025:10119

RHSA-2025:10120

Affected Products

Eclipse Jetty

References · 20

• https://github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8 · Vendor Advisory
• https://security-tracker.debian.org/tracker/CVE-2025-1948 · Vendor Advisory
• https://ubuntu.com/security/CVE-2025-1948 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2025-1948 · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-889j-63jv-qhr8 · Vendor Advisory
• https://osv.dev/vulnerability/DEBIAN-CVE-2025-1948 · Vendor Advisory
• https://cve.org/CVERecord?id=CVE-2025-1948 · Security Note
• https://osv.dev/vulnerability/UBUNTU-CVE-2025-1948 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2025-1948 · Security Note
• https://github.com/jetty/jetty.project · Note
• https://github.com/jetty/jetty.project/issues/12690 · Note
• https://github.com/jetty/jetty.project/commit/c8c2515936ef968dc8a3cecd9e79d1e69291e4bb · Note
• https://t.me/latest_high_impact_cve/2303 · Telegram Post
• https://t.me/cvetracker/23378 · Telegram Post
• https://twitter.com/CVEnew/status/1920544487857926453 · Twitter Post