CyberRota Analysis
AI-GeneratedA vulnerability exists in Jetty where a client can send a WebSocket frame with an unknown opcode and a large declared payload length, leading to excessive memory allocation that may exhaust the JVM heap. This issue arises when auto-fragmentation is enabled, allowing unknown opcodes to bypass standard frame size checks. Organizations using Jetty, particularly those with WebSocket implementations, should prioritize addressing this vulnerability to prevent potential denial-of-service conditions.
Public Exploit Signal
A public exploit, PoC, GitHub repository or Metasploit reference was detected for this CVE.
Note: these links are listed for security research and verification purposes only.
Original NVD Description
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.