CVE-2018-12545CWE-400

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames…

published March 27, 2019

CVSS
—
EPSS
5%
Percentile
92.4
In the wild
Unconfirmed
What it is

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

The record
Technical detail
CVSS
Not scored
CVSS v4.0
Not supplied
EPSS
0.05124 · 92.4th percentile
Weakness
CWE-400 · Uncontrolled Resource Consumption
Published
2019-03-27T19:21Z
EPSS history
Timeline
  • 27 MAR 19:21Z
    In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames…
    cvelistv5