Machine-written summary
Summary written by Claude Haiku from the source advisory. Not reviewed by a person.
Eclipse Jetty's jetty-http2-common package, versions 12.0.0 through 12.0.16, is vulnerable. A remote HTTP/2 client can set the SETTINGS_MAX_HEADER_LIST_SIZE parameter to a very large value, causing the server to allocate a huge buffer that can trigger OutOfMemoryError or make the JVM exit. Upgrade to version 12.0.17. No workarounds are listed.
Not analysed yet
We haven’t published our analysis of this Advisory yet. Once a person has reviewed it, this page will say what’s vulnerable, what has to be true for your app to be affected, and how to check.
Severity and exploitation
| Score | Rating | CVSS | Vector | Source |
|---|---|---|---|---|
| 7.5 | High | 3.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H | CNA (eclipse) |
- CISA KEV Not listed.
- EPSS 0.0079, the 56th percentile, on 13 Nov 2026: FIRST’s estimate of the chance of exploitation in the next 30 days.
Timeline
- 8 May 2025, 17:57 UTC Published by the maintainers as a GitHub repository advisory
- 31 Oct 2026, 14:17 UTC First seen by agentprime
- 31 Oct 2026, 14:17 UTC Confirmed by OSV
Sources
- GitHub Advisory Database: GHSA-889j-63jv-qhr8
- OSV: GHSA-889j-63jv-qhr8
- github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8
- nvd.nist.gov/vuln/detail/CVE-2025-1948
- github.com/jetty/jetty.project/issues/12690
- github.com/jetty/jetty.project/commit/c8c2515936ef968dc8a3cecd9e79d1e69291e4bb
- github.com/jetty/jetty.project
- gitlab.eclipse.org/security/cve-assignement/-/issues/56