CVE-2026-19204

Name	CVE-2026-19204
Description	A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.
Source	CVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
jetty12 (PTS)	trixie (security), trixie	12.0.17-3.1~deb13u1	undetermined
	forky, sid	12.0.33-1	undetermined
jetty9 (PTS)	bookworm, bookworm (security)	9.4.57-1.1~deb12u1	undetermined
	trixie (security), trixie	9.4.57-1.1~deb13u1	undetermined
	forky, sid	9.4.58-2	undetermined

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Origin	Debian Bugs
jetty12	source	(unstable)	undetermined
jetty9	source	(unstable)	undetermined

https://github.com/jetty/jetty.project/security/advisories/GHSA-85fq-fc5f-7j7g
check, GHSA reference not yet public