CVE-2026-19204

Name of the Vulnerable Software and Affected Versions Jetty (affected versions not specified)

Description A client can send a WebSocket frame containing an unknown opcode and an excessively large declared payload length. When auto-fragmentation is enabled, unknown opcodes bypass standard maximum frame size checks, leading the system to attempt a large memory allocation before the opcode is validated. This process can exhaust the JVM heap, potentially causing a denial of service.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.