CVE-2025-1948

Name	CVE-2025-1948
Description	In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jetty12 (PTS)	sid, trixie	12.0.17-3	fixed
jetty9 (PTS)	bullseye	9.4.50-4+deb11u2	fixed
	bullseye (security)	9.4.57-0+deb11u2	fixed
	bookworm	9.4.50-4+deb12u3	fixed
	bookworm (security)	9.4.57-0+deb12u1	fixed
	sid, trixie	9.4.57-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version
jetty	source	(unstable)	(not affected)
jetty12	source	(unstable)	12.0.17-1
jetty9	source	(unstable)	(not affected)

Notes

- jetty9 <not-affected> (Only affects 12.x)
- jetty <not-affected> (Only affects 12.x)
https://github.com/jetty/jetty.project/security/advisories/GHSA-889j-63jv-qhr8
https://github.com/jetty/jetty.project/issues/12690