https://cve.radiocsirt.org Contains only the most 10 recent entries. http://www.rssboard.org/rss-specification python-feedgen en Fri, 02 Oct 2026 22:36:56 +0000 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0844 certfr-2025-avi-0844 https://cve.radiocsirt.org/vuln/certfr-2025-avi-0844 https://cve.radiocsirt.org/vuln/cleanstart-2026-ms35151 <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Security vulnerability affects the apache-nifi package. In Eclipse Jetty versions 12.</p> <p><strong>Affected:</strong> CleanStart: apache-nifi</p> <p>Security vulnerability affects the apache-nifi package. In Eclipse Jetty versions 12.</p> https://cve.radiocsirt.org/vuln/cleanstart-2026-ms35151 https://cve.radiocsirt.org/vuln/euvd-2026-238496 EUVD-2026-238496 https://cve.radiocsirt.org/vuln/euvd-2026-238496 https://cve.radiocsirt.org/vuln/fkie_cve-2025-1948 <p>In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.</p> <p>In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.</p> https://cve.radiocsirt.org/vuln/fkie_cve-2025-1948 https://cve.radiocsirt.org/vuln/ghsa-889j-63jv-qhr8 <p><strong>Affected:</strong> Maven: org.eclipse.jetty.http2:jetty-http2-common</p> <p>### Original Report</p> <p>In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.</p> <p>### Impact Remote peers can cause the JVM to crash or continuously report OOM.</p> <p>### Patches 12.0.17</p> <p>### Workarounds No workarounds.</p> <p>### References https://github.com/jetty/jetty.project/issues/12690</p> <p><strong>Affected:</strong> Maven: org.eclipse.jetty.http2:jetty-http2-common</p> <p>### Original Report</p> <p>In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.</p> <p>### Impact Remote peers can cause the JVM to crash or continuously report OOM.</p> <p>### Patches 12.0.17</p> <p>### Workarounds No workarounds.</p> <p>### References https://github.com/jetty/jetty.project/issues/12690</p> https://cve.radiocsirt.org/vuln/ghsa-889j-63jv-qhr8 https://cve.radiocsirt.org/vuln/rhsa-2025:10092 <p>json-smart: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370) jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError</p> <p>json-smart: Potential DoS via stack exhaustion (incomplete fix for CVE-2023-1370) jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability spring-security-core: Spring Security BCryptPasswordEncoder does not enforce maximum password length com.fasterxml.jackson.core/jackson-core: jackson-core Potential StackoverflowError</p> https://cve.radiocsirt.org/vuln/rhsa-2025:10092 https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-1948 <p><strong>Affected:</strong> Ubuntu:14.04:LTS: jetty, Ubuntu:16.04:LTS: jetty, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9, Ubuntu:24.04:LTS: jetty9, Ubuntu:25.10: jetty9, Ubuntu:26.04:LTS: jetty9</p> <p>In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.</p> <p><strong>Affected:</strong> Ubuntu:14.04:LTS: jetty, Ubuntu:16.04:LTS: jetty, Ubuntu:16.04:LTS: jetty9, Ubuntu:18.04:LTS: jetty9, Ubuntu:20.04:LTS: jetty9, Ubuntu:22.04:LTS: jetty9, Ubuntu:24.04:LTS: jetty9, Ubuntu:25.10: jetty9, Ubuntu:26.04:LTS: jetty9</p> <p>In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGS_MAX_HEADER_LIST_SIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified capacity to encode HTTP responses, likely resulting in OutOfMemoryError being thrown, or even the JVM process exiting.</p> https://cve.radiocsirt.org/vuln/ubuntu-cve-2025-1948 https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0987 <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um Daten zu manipulieren oder einen Denial-of-Service auszulösen.</p> <p>Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Eclipse Jetty ausnutzen, um Daten zu manipulieren oder einen Denial-of-Service auszulösen.</p> https://cve.radiocsirt.org/vuln/wid-sec-w-2025-0987