The Eclipse Jetty Server Artifact has a Gzip request memory leak

🗓️ 05 Mar 2026 21:27:59Reported by GitHub Advisory DatabaseType

Jetty GzipHandler in jetty-12.0.30 leaks inflaters during gzip request inflation, causing off-heap memory OOMs.

Reporter	Title	Published	Views	Family All 106
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in jetty-server (CVE-2026-1605)	4 May 202616:06	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of jetty-server-12.0.16.jar, IBM Sterling Connect:Direct Web Services is affected by response not compressed issue for corresponding HTTP request, causing the leak.	23 Apr 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling External Authentication Server is vulnerable to multiple issues	27 Jul 202606:00	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.1.1	31 Mar 202616:18	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Engineering Systems Design Rhapsody was affected by CVE-2026-1605	15 Jun 202606:17	–	ibm
IBM Security Bulletins	Security Bulletin: Security Vulnerability in Eclipse Jetty affects IBM Sterling B2B Integrator and IBM Sterling File Gateway (CVE-2026-1605)	24 Jul 202619:32	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-1605, CVE-2026-29063, CVE-2025-11143, CVE-2026-2332, CVE-2025-15599, CVE-2026-0540)	27 Apr 202615:06	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Sterling Secure Proxy is vulnerable to multiple issues	24 Jun 202606:12	–	ibm
IBM Security Bulletins	Security Bulletin: MongoDB Enterprised Advanced affected by: Uncontrolled Resource Consumption (CVE-2026-1605)	16 Jun 202617:10	–	ibm
IBM Security Bulletins	Security Bulletin: IBM Maximo Application Suite - IoT Component uses multiple third party dependencies which is vulnerable to multiple CVEs.	3 Aug 202614:48	–	ibm

Vulners

Node

org.eclipse.jetty jetty-serverRange12.0.0–12.0.31maven

org.eclipse.jetty jetty-serverRange12.1.0–12.1.5maven

Source	Link
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-1605
github	www.github.com/jetty/jetty.project/issues/14260
gitlab	www.gitlab.eclipse.org/security/cve-assignment/-/issues/79
github	www.github.com/advisories/GHSA-xxh7-fcf3-rj7f

06 Mar 2026 22:52Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00625

SSVC