The vulnerability allows a client to send a WebSocket frame with an unknown opcode and a very large declared payload length. Jetty attempts to allocate memory for that payload before validating the opcode, which can lead to excessive memory consumption and ultimately a JVM Out‑of‑Memory error or crash. This constitutes a denial‑of‑service attack through resource exhaustion, corresponding to the CWE-770, CWE-789, and CWE-1284 weaknesses.

This issue is present in Eclipse Jetty WebSocket server components when auto‑fragmentation is enabled. No specific affected product versions are listed in the advisory, so all Jetty deployments that use the WebSocket module with auto‑fragmentation may be vulnerable. The advisory on GitHub points to the Jetty project for official fixes.

The CVSS score of 8.7 signals a high impact, and although the EPSS score is < 1%, the possibility of remote exploitation remains significant. The vulnerability is not listed in the CISA KEV catalog, but the lack of mitigations means that any external actor able to send WebSocket traffic could trigger the flaw. By sending a frame with an unknown opcode and a very large payload length, the attacker forces Jetty to allocate a huge amount of memory before performing opcode validation, which can lead to a JVM out‑of‑memory error and service disruption.