Web Application Vulnerabilities Runtime SCA Findings
Looking for the vulnerability index of Invicti's legacy products?
Invicti Enterprise Acunetix Standard & Premium
Jetty Uncontrolled Resource Consumption Vulnerability - CVE-2025-1948 - Vulnerability Database
Jetty

Jetty Uncontrolled Resource Consumption Vulnerability - CVE-2025-1948

High
Reference: CVE-2025-1948
NVD Link: https://nvd.nist.gov/vuln/detail/CVE-2025-1948
Title: Jetty Uncontrolled Resource Consumption Vulnerability
Overview:

In Eclipse Jetty versions 12.0.0 to 12.0.16 included an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses likely resulting in OutOfMemoryError being thrown or even the JVM process exiting.