The Eclipse Jetty Server Artifact has a Gzip request memory leak

🗓️ 05 Mar 2026 21:27:59Reported by GitHub Advisory DatabaseType

Jetty GzipHandler in jetty-12.0.30 leaks inflaters during gzip request inflation, causing off-heap memory OOMs.

Reporter	Title	Published	Views	Family All 77
IBM Security Bulletins	Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in jetty-server (CVE-2026-1605)	4 May 202616:06	–	ibm
IBM Security Bulletins	Security Bulletin: Due to use of jetty-server-12.0.16.jar, IBM Sterling Connect:Direct Web Services is affected by response not compressed issue for corresponding HTTP request, causing the leak.	23 Apr 202606:56	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple security vulnerabilities are addressed with IBM Process Mining 2.1.1	31 Mar 202616:18	–	ibm
IBM Security Bulletins	Security Bulletin: Multiple vulnerabilities in IBM Rational Developer for i (CVE-2026-1605, CVE-2026-29063, CVE-2025-11143, CVE-2026-2332, CVE-2025-15599, CVE-2026-0540)	27 Apr 202615:06	–	ibm
ATTACKERKB	CVE-2026-1605	5 Mar 202609:39	–	attackerkb
Chainguard	CVE-2026-1605 vulnerabilities	7 Mar 202619:30	–	cgr
Circl	CVE-2026-1605	5 Mar 202610:18	–	circl
CNNVD	Eclipse Jetty 安全漏洞	5 Mar 202600:00	–	cnnvd
CVE	CVE-2026-1605	5 Mar 202609:39	–	cve
Cvelist	CVE-2026-1605	5 Mar 202609:39	–	cvelist

Vulners

Node

Source	Link
github	www.github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f
nvd	www.nvd.nist.gov/vuln/detail/CVE-2026-1605
github	www.github.com/jetty/jetty.project/issues/14260
gitlab	www.gitlab.eclipse.org/security/cve-assignment/-/issues/79
github	www.github.com/advisories/GHSA-xxh7-fcf3-rj7f

06 Mar 2026 22:52Current

5.9Medium risk

Vulners AI Score5.9

CVSS 3.17.5

EPSS0.00033

SSVC