1102 matches found
Exposure of Data Element to Wrong Session
Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Exposure of Data Element to Wrong Session due to the connection-scoped trailers handling in the HTTP/1.1 request processing path. ...
SUSE CVE-2026-10051
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the...
UBUNTU-CVE-2026-10051
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the...
ai.agentscentral:agentj-jetty (>=0.0.4, <=0.0.6), app.cash.tempest:tempest-testing-jvm (>=1.4.0, <=2025.04.17.121601-f8f94b6) +1926 more potentially affected by CVE-2026-6790 via org.eclipse.jetty:jetty-server (>=12.0.0, <=12.0.34)
org.eclipse.jetty:jetty-server MAVEN version =12.0.0, =0.0.4, =1.4.0, =1.4.0, =7.0.0, =4.2.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-6790 Source advisory: MEND:CVE-2026-6790...
ai.agentscentral:agentj-jetty (>=0.0.4, <=0.0.6), app.cash.tempest:tempest-testing-jvm (>=1.4.0, <=2025.04.17.121601-f8f94b6) +1928 more potentially affected by CVE-2026-10051 via org.eclipse.jetty:jetty-server (>=12.0.0, <=12.0.35)
org.eclipse.jetty:jetty-server MAVEN version =12.0.0, =0.0.4, =1.4.0, =1.4.0, =7.0.0, =4.2.0, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.2, =2.1.21 and more Source cves: CVE-2026-10051 Source advisory: MEND:CVE-2026-10051...
CVE-2026-10051
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the...
CVE-2026-10051
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the...
PT-2026-57983
Name of the Vulnerable Software and Affected Versions Eclipse Jetty affected versions not specified Description A flaw in the handling of HTTP/1.1 requests allows the server to retain trailers from an initial request and apply them to subsequent requests made over the same connection. If a...
org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustio...
org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustio...
org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustio...
Security Bulletin: Vulnerabilities exists in IBM Cloud Pak for Data System (CPDS 1.0) - NRS.
Summary Vulnerabilities exists in IBM Cloud Pak for Data System CPDS 1.0 - NRS addressed in 3.0.5.1. Vulnerability Details CVEID:CVE-2024-6763 DESCRIPTION: Eclipse Jetty is a lightweight, highly scalable, Java-based web server and Servlet engine . It includes a utility class, HttpURI, for URI/URL...
Security Bulletin: IBM Sterling Control Center is affected by vulnerabilities in jetty-server (CVE-2026-1605)
Summary IBM Sterling Control Center is affected by a vulnerability CVE-2026-1605 reported for jetty-server-12.0.25.jar. Vulnerability Details CVEID:CVE-2026-1605 DESCRIPTION: In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed...
org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests
A flaw was found in org.eclipse.jetty. A remote attacker can exploit this vulnerability by sending a compressed HTTP request with Content-Encoding: gzip when the server's response is not compressed. This prevents the release of the JDK Inflater, leading to a resource leak. This resource exhaustio...
UBUNTU-CVE-2026-2332
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...
CVE-2026-2332
In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...
ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3) +1352 more potentially affected by CVE-2026-1605 via org.eclipse.jetty:jetty-server (>=12.1.0, <=12.1.5)
org.eclipse.jetty:jetty-server MAVEN version =12.1.0, =0.1.7, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.5.0, =0.9.0, =0.2.1-alpha, =0.2.1-alpha, =0.6.12 and more Source cves: CVE-2026-1605 Source advisory: GHSA-XXH7-FCF3-RJ7F...
The Eclipse Jetty Server Artifact has a Gzip request memory leak
Description as reported There is a memory leak when using GzipHandler in jetty-12.0.30 that can cause off-heap OOMs. This can be used for DoS attacks so I'm reporting this as a vulnerability. The leak is created by requests where the request is inflated Content-Encoding: gzip and the response is...
ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3) +1352 more potentially affected by CVE-2026-1605 via org.eclipse.jetty:jetty-server (>=12.1.0, <=12.1.5)
org.eclipse.jetty:jetty-server MAVEN version =12.1.0, =0.1.7, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.5.0, =0.9.0, =0.2.1-alpha, =0.2.1-alpha, =0.6.12 and more Source cves: CVE-2026-1605 Source advisory: OSV:GHSA-XXH7-FCF3-RJ7F...
Interpretation Conflict
Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Interpretation Conflict due to inconsistent handling of invalid or unusual URIs in the parse function on HttpURI.java. An attacke...