https://cve.radiocsirt.org/rss/recent/all/10 Most recent entries from all 2026-10-02T22:38:34.036481+00:00 Vulnerability-Lookup csirt@opendfir.org python-feedgen Contains only the most 10 recent entries. https://cve.radiocsirt.org/vuln/certfr-2025-avi-0844 certfr-2025-avi-0844 — De multiples vulnérabilités ont été découvertes dans IBM Sterling Connect. Certaines d'entre elles permettent à un atta… 2026-10-02T22:38:34.055161+00:00 certfr-2025-avi-0844 https://cve.radiocsirt.org/vuln/cleanstart-2026-ms35151 CLEANSTART-2026-MS35151 — In Eclipse Jetty versions 12 2026-10-02T22:38:34.055247+00:00

Affected: CleanStart: apache-nifi

Security vulnerability affects the apache-nifi package. In Eclipse Jetty versions 12.

 https://cve.radiocsirt.org/vuln/euvd-2026-238496 EUVD-2026-238496 2026-10-02T22:38:34.055301+00:00 EUVD-2026-238496 https://cve.radiocsirt.org/vuln/fkie_cve-2025-1948 fkie_cve-2025-1948 2026-10-02T22:38:34.055316+00:00

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

 https://cve.radiocsirt.org/vuln/ghsa-889j-63jv-qhr8 GHSA-889j-63jv-qhr8 — Eclipse Jetty HTTP/2 client can force the server to allocate a humongous byte buffer that may lead to OoM and subsequen… 2026-10-02T22:38:34.055339+00:00

Affected: Maven: org.eclipse.jetty.http2:jetty-http2-common

### Original Report

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

### Impact Remote peers can cause the JVM to crash or continuously report OOM.

### Patches 12.0.17

### Workarounds No workarounds.

### References https://github.com/jetty/jetty.project/issues/12690

 https://cve.radiocsirt.org/vuln/rhsa-2025:10092 RHSA-2025:10092 — Red Hat Security Advisory: Red Hat Product OCP Tools 4.18 OpenShift Jenkins security update 2026-10-02T22:38:34.055368+00:00

json-smart: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370) jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError

 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-1948 UBUNTU-CVE-2025-1948 2026-10-02T22:38:34.055391+00:00

Affected: Ubuntu:14.04:LTS: jetty, Ubuntu:16.04:LTS: jetty, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9, Ubuntu:24.04:LTS: jetty9, Ubuntu:25.10: jetty9, Ubuntu:26.04:LTS: jetty9

In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.

 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0987 WID-SEC-W-2025-0987 — Eclipse Jetty: Mehrere Schwachstellen 2026-10-02T22:38:34.055450+00:00

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um Daten zu manipulieren oder einen Denial-of-Service auszulösen.