CVE-2026-19204
UNKNOWN
NVD
CVSS Score
0
Severity
UNKNOWN
Published
Sep 07, 2026
Vendor
unknown
Description
A client may send a WebSocket frame with an unknown opcode and a very large declared payload length, causing Jetty to attempt a large memory allocation and potentially exhaust the JVM heap. This occurs when auto-fragmentation is enabled, as unknown opcodes bypass the normal maximum frame size handling and payload allocation occurs before the opcode is validated.