CVE-2026-19204
Quick assessment
Affected
Eclipse Foundation Eclipse Jetty
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.
客户端可能发送带有未知操作码（opcode）和极大声明负载长度的 WebSocket 帧，导致 Jetty 尝试进行大内存分配，从而可能耗尽 JVM 堆内存。 该问题在启用自动分片（auto-fragmentation）时发生，因为未知操作码会绕过常规的最大帧大小处理逻辑，且负载分配发生在操作码校验之前。
Possible ATT&CK Techniques 2 AI
T1190 · Exploit Public-Facing Application T1025 · Data from Removable Media
Get alerts for future matching vulnerabilities
Log in to subscribe
I. Basic Information for CVE-2026-19204
Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗
Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.
Vulnerability Title
N/A
Source: CVE Program / CVE List V5
Vulnerability Description
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap.
This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N
Source: CVE Program / CVE List V5
Vulnerability Type
不加限制或调节的资源分配
Source: CVE Program / CVE List V5
Affected Products
| Vendor | Product | Affected Versions | CPE | Subscribe |
|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | 12.1.0 ~ 12.1.11 | - |
|
II. Public POCs for CVE-2026-19204
| # | POC Description | Source Link | Shenlong Link |
|---|
AI-Generated POC
Premium
No public POC found.
Login to generate AI POCIII. Intelligence Information for CVE-2026-19204
请登录查看更多情报信息。
Other References for CVE-2026-19204 (1)
Same Patch Batch · Eclipse Foundation · 2026-09-07 · 3 CVEs total
| CVE-2026-84173 | 8.3 HIGH | CVE-2026-84173 |
| CVE-2026-85201 | 6.8 MEDIUM | Eclipse Ankaios 0.1.0-1.0.1 内存分配越界漏洞 |
IV. Related Vulnerabilities
Same weakness: CWE-770
-
CVE-2025-52657
HCL MyXalytics is affected by multiple security vulnerabilit -
CVE-2022-51008
PocketMine-MP before 4.12.3 Denial of Service via Unauthenti -
CVE-2026-85703
ramon-victor freegpt-webui Jailbreak Mode backend.py getJail -
CVE-2026-84890
undici vulnerable to Denial of Service via unbounded decompr -
CVE-2026-85664
Chroma 1.5.9 Unbounded HNSW Index Parameters Memory Exhausti
V. Comments for CVE-2026-19204
No comments yet