A high-severity memory allocation vulnerability in Eclipse Jetty allows unauthenticated attackers to cause a denial of service by exhausting the JVM heap memory.

The flaw exists in the WebSocket frame handling logic when auto-fragmentation is enabled. An unauthenticated attacker can send a frame with an unknown opcode and a massive payload length, bypassing size constraints and forcing the server to allocate excessive memory.

This vulnerability poses a significant risk to service availability. By triggering a heap exhaustion event, an attacker can crash the Java Virtual Machine, leading to prolonged service outages and potential operational disruption. Given the CVSS score of 8.7, this flaw represents a high-impact risk to any public-facing application utilizing affected versions of Jetty.

Immediate Action: Monitor the official Eclipse Jetty GitHub security advisory page for the release of patched versions and apply the update as soon as it becomes available.

Proactive Monitoring: Review application and server logs for unusual WebSocket traffic patterns, particularly spikes in memory usage or frequent connection resets that may indicate exploitation attempts.

Compensating Controls: If immediate patching is not feasible, consider implementing a Web Application Firewall or load balancer rules to restrict WebSocket frame sizes or drop traffic containing malformed or suspicious opcodes.

Public Exploit Available: Unknown.

The risk of denial of service via memory exhaustion necessitates prompt action once the vendor releases a fix. Organizations should track the status of the Eclipse Jetty repository and prioritize the deployment of the security update across all affected environments to prevent potential service degradation.