CVE-2018-12545

In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.

• CWE-400
• CWE-770

• https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread.html/13f5241048ec0bf966a6ddd306feaf40de5b20e1f09096b9cddeddf2%40%3Ccommits.accumulo.apache.org%3E
• https://lists.apache.org/thread.html/70744fe4faba8e2fa7e50a7fc794dd03cb28dad8b21e08ee59bb1606%40%3Cdevnull.infra.apache.org%3E
• https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/febc94ffec9275dcda64633e0276a1400cd318e571009e4cda9b7a79%40%3Cnotifications.accumulo.apache.org%3E
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIS4LALKZNLF5X5IGNGRSKERG7FY4QG6/
• https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlPatch, Third Party Advisory
• https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096Issue Tracking, Vendor Advisory
• https://lists.apache.org/thread.html/13f5241048ec0bf966a6ddd306feaf40de5b20e1f09096b9cddeddf2%40%3Ccommits.accumulo.apache.org%3E
• https://lists.apache.org/thread.html/70744fe4faba8e2fa7e50a7fc794dd03cb28dad8b21e08ee59bb1606%40%3Cdevnull.infra.apache.org%3E
• https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E
• https://lists.apache.org/thread.html/febc94ffec9275dcda64633e0276a1400cd318e571009e4cda9b7a79%40%3Cnotifications.accumulo.apache.org%3E
• https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E
• https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIS4LALKZNLF5X5IGNGRSKERG7FY4QG6/
• https://www.oracle.com/security-alerts/cpuoct2020.htmlThird Party Advisory
• https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.htmlPatch, Third Party Advisory

Published

Mar 27, 2019

Last Modified

Jun 17, 2026

Status

Modified

• How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
• Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
• PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
• AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.

• CVE-2018-1254RSA Authentication Manager Security Console, versions 8.3 P1…
• CVE-2018-12540In version from 3.0.0 to 3.5.2 of Eclipse Vert.x, the CSRFHa…
• CVE-2018-12541In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the WebSoc…6.5
• CVE-2018-12542In version from 3.0.0 to 3.5.3 of Eclipse Vert.x, the Static…
• CVE-2018-12543In Eclipse Mosquitto versions 1.5 to 1.5.2 inclusive, if a m…
• CVE-2018-12544In version from 3.5.Beta1 to 3.5.3 of Eclipse Vert.x, the Op…
• CVE-2018-12546In Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) when a…6.5
• CVE-2018-12547In Eclipse OpenJ9, prior to the 0.12.0 release, the jio_snpr…
• CVE-2018-12548In OpenJDK + Eclipse OpenJ9 version 0.11.0 builds, the publi…
• CVE-2018-12549In Eclipse OpenJ9 version 0.11.0, the OpenJ9 JIT compiler ma…
• CVE-2018-1255RSA Identity Lifecycle and Governance versions 7.0.1, 7.0.2 …6.1
• CVE-2018-12550When Eclipse Mosquitto version 1.0 to 1.5.5 (inclusive) is c…