{"id":"CVE-2018-12545","details":"In Eclipse Jetty version 9.3.x and 9.4.x, the server is vulnerable to Denial of Service conditions if a remote client sends either large SETTINGs frames container containing many settings, or many small SETTINGs frames. The vulnerability is due to the additional CPU and memory allocations required to handle changed settings.","aliases":["GHSA-h2f4-v4c4-6wx4"],"modified":"2026-09-06T03:45:07.134674484Z","published":"2019-03-27T20:29:03.630Z","database_specific":{"unresolved_ranges":[{"cpes":["cpe:2.3:o:fedoraproject:fedora:28:*:*:*:*:*:*:*"],"extracted_events":[{"introduced":"28"},{"last_affected":"28"}],"source":"CPE_STRING","vendor_product":"fedoraproject:fedora"}]},"references":[{"type":"WEB","url":"https://lists.apache.org/thread.html/13f5241048ec0bf966a6ddd306feaf40de5b20e1f09096b9cddeddf2%40%3Ccommits.accumulo.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/70744fe4faba8e2fa7e50a7fc794dd03cb28dad8b21e08ee59bb1606%40%3Cdevnull.infra.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/9317fd092b257a0815434b116a8af8daea6e920b6673f4fd5583d5fe%40%3Ccommits.druid.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/febc94ffec9275dcda64633e0276a1400cd318e571009e4cda9b7a79%40%3Cnotifications.accumulo.apache.org%3E"},{"type":"WEB","url":"https://lists.apache.org/thread.html/ff8dcfe29377088ab655fda9d585dccd5b1f07fabd94ae84fd60a7f8%40%3Ccommits.pulsar.apache.org%3E"},{"type":"WEB","url":"https://lists.fedoraproject.org/archives/list/package-announce%40lists.fedoraproject.org/message/CIS4LALKZNLF5X5IGNGRSKERG7FY4QG6/"},{"type":"ADVISORY","url":"https://www.oracle.com/security-alerts/cpuoct2020.html"},{"type":"REPORT","url":"https://bugs.eclipse.org/bugs/show_bug.cgi?id=538096"},{"type":"FIX","url":"https://www.oracle.com/technetwork/security-advisory/cpuoct2019-5072832.html"}],"affected":[{"ranges":[{"type":"GIT","repo":"https://github.com/jetty/jetty.project","events":[{"introduced":"da11e86bccbcbd65a72012543c114a0af8a86d6f"},{"last_affected":"1f9703cf836af6c70ac0665fbc6790c0a8229a7a"}],"database_specific":{"source":"CPE_STRING","cpe":["cpe:2.3:a:eclipse:jetty:9.3.0:20150601:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:20150608:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:20150612:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:maintenance0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:maintenance1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:maintenance2:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.0:rc1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.1:20150714:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.2:20150730:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.3:20150825:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.3:20150827:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.4:20151005:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.4:20151007:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.4:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.4:rc1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.5:20151012:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.6:20151106:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.7:20160115:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.7:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.7:rc1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.8:20160311:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.8:20160314:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.8:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.9:20160517:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.9:maintenance_1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.10:20160621:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.10:maintenance_0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.11:20160721:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.11:maintenance_0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.12:20160915:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.13:20161014:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.13:maintenance_0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.14:20161028:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.15:20161220:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.16:20170119:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.16:20170120:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.17:20170317:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.17:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.18:20170406:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.19:20170502:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.20:20170531:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.21:20170918:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.21:maintenance_0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.21:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.22:20171030:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.23:20180228:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.3.24:20180605:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.0:20161207:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.0:20161208:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.0:20180619:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.0:maintenance_0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.0:maintenance_1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.0:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.0:rc1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.0:rc2:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.0:rc3:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.1:20170120:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.1:20180619:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.2:20170220:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.2:20180619:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.3:20170317:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.3:20180619:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.4:20170410:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.4:20170414:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.4:20180619:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.5:20170502:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.5:20180619:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.6:20170531:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.6:20180619:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.7:20170914:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.7:20180619:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.7:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.8:20171121:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.8:20180619:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.9:20180320:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.10:20180503:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.10:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.10:rc1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.11:20180605:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.12:rc0:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.12:rc1:*:*:*:*:*:*","cpe:2.3:a:eclipse:jetty:9.4.12:rc2:*:*:*:*:*:*"],"extracted_events":[{"introduced":"9.3.0-20150601"},{"last_affected":"9.3.0-20150601"},{"introduced":"9.3.0-20150608"},{"last_affected":"9.3.0-20150608"},{"introduced":"9.3.0-20150612"},{"last_affected":"9.3.0-20150612"},{"introduced":"9.3.0-maintenance0"},{"last_affected":"9.3.0-maintenance0"},{"introduced":"9.3.0-maintenance1"},{"last_affected":"9.3.0-maintenance1"},{"introduced":"9.3.0-maintenance2"},{"last_affected":"9.3.0-maintenance2"},{"introduced":"9.3.0-rc0"},{"last_affected":"9.3.0-rc0"},{"introduced":"9.3.0-rc1"},{"last_affected":"9.3.0-rc1"},{"introduced":"9.3.1-20150714"},{"last_affected":"9.3.1-20150714"},{"introduced":"9.3.2-20150730"},{"last_affected":"9.3.2-20150730"},{"introduced":"9.3.3-20150825"},{"last_affected":"9.3.3-20150825"},{"introduced":"9.3.3-20150827"},{"last_affected":"9.3.3-20150827"},{"introduced":"9.3.4-20151005"},{"last_affected":"9.3.4-20151005"},{"introduced":"9.3.4-20151007"},{"last_affected":"9.3.4-20151007"},{"introduced":"9.3.4-rc0"},{"last_affected":"9.3.4-rc0"},{"introduced":"9.3.4-rc1"},{"last_affected":"9.3.4-rc1"},{"introduced":"9.3.5-20151012"},{"last_affected":"9.3.5-20151012"},{"introduced":"9.3.6-20151106"},{"last_affected":"9.3.6-20151106"},{"introduced":"9.3.7-20160115"},{"last_affected":"9.3.7-20160115"},{"introduced":"9.3.7-rc0"},{"last_affected":"9.3.7-rc0"},{"introduced":"9.3.7-rc1"},{"last_affected":"9.3.7-rc1"},{"introduced":"9.3.8-20160311"},{"last_affected":"9.3.8-20160311"},{"introduced":"9.3.8-20160314"},{"last_affected":"9.3.8-20160314"},{"introduced":"9.3.8-rc0"},{"last_affected":"9.3.8-rc0"},{"introduced":"9.3.9-20160517"},{"last_affected":"9.3.9-20160517"},{"introduced":"9.3.9-maintenance_0"},{"last_affected":"9.3.9-maintenance_0"},{"introduced":"9.3.9-maintenance_1"},{"last_affected":"9.3.9-maintenance_1"},{"introduced":"9.3.10-20160621"},{"last_affected":"9.3.10-20160621"},{"introduced":"9.3.10-maintenance_0"},{"last_affected":"9.3.10-maintenance_0"},{"introduced":"9.3.11-20160721"},{"last_affected":"9.3.11-20160721"},{"introduced":"9.3.11-maintenance_0"},{"last_affected":"9.3.11-maintenance_0"},{"introduced":"9.3.12-20160915"},{"last_affected":"9.3.12-20160915"},{"introduced":"9.3.13-20161014"},{"last_affected":"9.3.13-20161014"},{"introduced":"9.3.13-maintenance_0"},{"last_affected":"9.3.13-maintenance_0"},{"introduced":"9.3.14-20161028"},{"last_affected":"9.3.14-20161028"},{"introduced":"9.3.15-20161220"},{"last_affected":"9.3.15-20161220"},{"introduced":"9.3.16-20170119"},{"last_affected":"9.3.16-20170119"},{"introduced":"9.3.16-20170120"},{"last_affected":"9.3.16-20170120"},{"introduced":"9.3.17-20170317"},{"last_affected":"9.3.17-20170317"},{"introduced":"9.3.17-rc0"},{"last_affected":"9.3.17-rc0"},{"introduced":"9.3.18-20170406"},{"last_affected":"9.3.18-20170406"},{"introduced":"9.3.19-20170502"},{"last_affected":"9.3.19-20170502"},{"introduced":"9.3.20-20170531"},{"last_affected":"9.3.20-20170531"},{"introduced":"9.3.21-20170918"},{"last_affected":"9.3.21-20170918"},{"introduced":"9.3.21-maintenance_0"},{"last_affected":"9.3.21-maintenance_0"},{"introduced":"9.3.21-rc0"},{"last_affected":"9.3.21-rc0"},{"introduced":"9.3.22-20171030"},{"last_affected":"9.3.22-20171030"},{"introduced":"9.3.23-20180228"},{"last_affected":"9.3.23-20180228"},{"introduced":"9.3.24-20180605"},{"last_affected":"9.3.24-20180605"},{"introduced":"9.4.0-20161207"},{"last_affected":"9.4.0-20161207"},{"introduced":"9.4.0-20161208"},{"last_affected":"9.4.0-20161208"},{"introduced":"9.4.0-20180619"},{"last_affected":"9.4.0-20180619"},{"introduced":"9.4.0-maintenance_0"},{"last_affected":"9.4.0-maintenance_0"},{"introduced":"9.4.0-maintenance_1"},{"last_affected":"9.4.0-maintenance_1"},{"introduced":"9.4.0-rc0"},{"last_affected":"9.4.0-rc0"},{"introduced":"9.4.0-rc1"},{"last_affected":"9.4.0-rc1"},{"introduced":"9.4.0-rc2"},{"last_affected":"9.4.0-rc2"},{"introduced":"9.4.0-rc3"},{"last_affected":"9.4.0-rc3"},{"introduced":"9.4.1-20170120"},{"last_affected":"9.4.1-20170120"},{"introduced":"9.4.1-20180619"},{"last_affected":"9.4.1-20180619"},{"introduced":"9.4.2-20170220"},{"last_affected":"9.4.2-20170220"},{"introduced":"9.4.2-20180619"},{"last_affected":"9.4.2-20180619"},{"introduced":"9.4.3-20170317"},{"last_affected":"9.4.3-20170317"},{"introduced":"9.4.3-20180619"},{"last_affected":"9.4.3-20180619"},{"introduced":"9.4.4-20170410"},{"last_affected":"9.4.4-20170410"},{"introduced":"9.4.4-20170414"},{"last_affected":"9.4.4-20170414"},{"introduced":"9.4.4-20180619"},{"last_affected":"9.4.4-20180619"},{"introduced":"9.4.5-20170502"},{"last_affected":"9.4.5-20170502"},{"introduced":"9.4.5-20180619"},{"last_affected":"9.4.5-20180619"},{"introduced":"9.4.6-20170531"},{"last_affected":"9.4.6-20170531"},{"introduced":"9.4.6-20180619"},{"last_affected":"9.4.6-20180619"},{"introduced":"9.4.7-20170914"},{"last_affected":"9.4.7-20170914"},{"introduced":"9.4.7-20180619"},{"last_affected":"9.4.7-20180619"},{"introduced":"9.4.7-rc0"},{"last_affected":"9.4.7-rc0"},{"introduced":"9.4.8-20171121"},{"last_affected":"9.4.8-20171121"},{"introduced":"9.4.8-20180619"},{"last_affected":"9.4.8-20180619"},{"introduced":"9.4.9-20180320"},{"last_affected":"9.4.9-20180320"},{"introduced":"9.4.10-20180503"},{"last_affected":"9.4.10-20180503"},{"introduced":"9.4.10-rc0"},{"last_affected":"9.4.10-rc0"},{"introduced":"9.4.10-rc1"},{"last_affected":"9.4.10-rc1"},{"introduced":"9.4.11-20180605"},{"last_affected":"9.4.11-20180605"},{"introduced":"9.4.12-rc0"},{"last_affected":"9.4.12-rc0"},{"introduced":"9.4.12-rc1"},{"last_affected":"9.4.12-rc1"},{"introduced":"9.4.12-rc2"},{"last_affected":"9.4.12-rc2"}]}}],"versions":["9.3.0-20150601","9.3.0-20150608","9.3.0-20150612","9.3.0-maintenance0","9.3.0-maintenance1","9.3.0-maintenance2","9.3.0-rc0","9.3.0-rc1","9.3.1-20150714","9.3.10-20160621","9.3.10-maintenance_0","9.3.11-20160721","9.3.11-maintenance_0","9.3.12-20160915","9.3.13-20161014","9.3.13-maintenance_0","9.3.14-20161028","9.3.15-20161220","9.3.16-20170119","9.3.16-20170120","9.3.17-20170317","9.3.17-rc0","9.3.18-20170406","9.3.19-20170502","9.3.2-20150730","9.3.20-20170531","9.3.21-20170918","9.3.21-maintenance_0","9.3.21-rc0","9.3.22-20171030","9.3.23-20180228","9.3.24-20180605","9.3.3-20150825","9.3.3-20150827","9.3.4-20151005","9.3.4-20151007","9.3.4-rc0","9.3.4-rc1","9.3.5-20151012","9.3.6-20151106","9.3.7-20160115","9.3.7-rc0","9.3.7-rc1","9.3.8-20160311","9.3.8-20160314","9.3.8-rc0","9.3.9-20160517","9.3.9-maintenance_0","9.3.9-maintenance_1","9.4.0-20161207","9.4.0-20161208","9.4.0-20180619","9.4.0-maintenance_0","9.4.0-maintenance_1","9.4.0-rc0","9.4.0-rc1","9.4.0-rc2","9.4.0-rc3","9.4.1-20170120","9.4.1-20180619","9.4.10-20180503","9.4.10-rc0","9.4.10-rc1","9.4.11-20180605","9.4.12-rc0","9.4.12-rc1","9.4.12-rc2","9.4.2-20170220","9.4.2-20180619","9.4.3-20170317","9.4.3-20180619","9.4.4-20170410","9.4.4-20170414","9.4.4-20180619","9.4.5-20170502","9.4.5-20180619","9.4.6-20170531","9.4.6-20180619","9.4.7-20170914","9.4.7-20180619","9.4.7-rc0","9.4.8-20171121","9.4.8-20180619","9.4.9-20180320"],"database_specific":{"source":"https://storage.googleapis.com/cve-osv-conversion/osv-output/CVE-2018-12545.json"}}],"schema_version":"1.9.0","severity":[{"type":"CVSS_V3","score":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H"}]}