CVE-2018-12545

Vulnerability

In Eclipse Jetty versions 9.3.x (up to 9.3.24.v20180605) and 9.4.x (up to 9.4.12.RC2), the HTTP/2 implementation fails to properly limit resource consumption when processing SETTINGS frames. A remote client can cause excessive CPU and memory allocation by sending either a large SETTINGS frame containing many settings or many small SETTINGS frames [1][3]. The issue is due to the additional processing required for each changed setting [1].

Exploitation

An unauthenticated remote attacker can exploit this vulnerability by establishing an HTTP/2 connection and sending a crafted sequence of SETTINGS frames. No special network position or user interaction is required; the attacker only needs to be able to send network traffic to the Jetty server [1]. The attack can be performed with either a single large SETTINGS frame containing many settings or a rapid succession of small SETTINGS frames [1].

Impact

Successful exploitation leads to a Denial of Service (DoS) condition. The server becomes unresponsive or crashes due to exhaustion of CPU time and memory, preventing legitimate users from accessing services [1]. The vulnerability does not allow for arbitrary code execution or data disclosure; its sole impact is on availability.

Mitigation

The vulnerability is fixed in Jetty versions 9.3.25.v20180904 and 9.4.12.v20180830 [3]. Users should upgrade to these or later versions. If immediate upgrade is not possible, network-level filters or rate-limiting of HTTP/2 connections may reduce exposure, but no official workaround is provided by the vendor.