CVE-2026-19204

Eclipse Jetty's WebSocket implementation allocates memory for a frame's declared payload length before validating the frame's opcode, so an unauthenticated network client can trigger a very large allocation by sending a single frame with an unknown opcode and an oversized declared payload length. This happens when WebSocket auto-fragmentation is enabled, because unknown opcodes bypass the normal maximum frame size handling. An attacker gains denial of service by exhausting the JVM heap, degrading or crashing the affected service (high availability impact, no confidentiality or integrity impact per the CVSS vector). Affected are any deployments running Jetty's WebSocket server with auto-fragmentation enabled that accept connections from untrusted clients. There is no known public proof of concept, it is not in the CISA KEV catalog, and EPSS currently puts 30-day exploitation probability at only 0.3% (22nd percentile).

What to do: Upgrade Jetty to the patched release for CVE-2026-19204 when available (fixed versions were not specified in the provided data) and prioritize deployments that run WebSocket servers with auto-fragmentation enabled and untrusted client access. As interim mitigation, restrict network access to WebSocket endpoints and monitor JVM heap for abnormal allocations; note that standard maximum-frame-size configuration may not prevent this because unknown opcodes bypass that check.