CVE-2026-19204: Eclipse Foundation Eclipse Jetty

High severity, CVSS 8.7. EPSS: 0.3% chance of exploitation in the next 30 days.

A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.

Affected products

• Eclipse Foundation Eclipse Jetty: from 12.1.0, up to and including 12.1.11; from 12.0.0, up to and including 12.0.37; from 11.0.0, up to and including 11.0.31; from 10.0.0, up to and including 10.0.31

Published 2026-09-07. Last modified 2026-09-08.