CVE-2026-19204

A flaw was found in Jetty. A remote attacker can exploit this vulnerability by sending a specially crafted WebSocket frame with an unknown operation code (opcode) and a very large declared payload length. When auto-fragmentation is enabled, these unknown opcodes bypass the normal maximum frame size handling, leading Jetty to attempt a large memory allocation before validating the opcode. This can cause the Java Virtual Machine (JVM) heap to be exhausted, resulting in a Denial of Service (DoS) for the affected system.

Jetty in affected Red Hat products can allow a remote attacker to exhaust the JVM heap by sending a crafted WebSocket frame with a reserved opcode and a large declared payload length to a reachable WebSocket endpoint. Auto-fragmentation is enabled by default, allowing allocation before the invalid opcode is rejected. Remediation is being pursued for affected shipped versions.

The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.

Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base, or stability.