UBUNTU-CVE-2026-2332

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...

CVE-2026-2332

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: https://w4ke.info/2025/06/18/funky-chunks.html https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3) +1352 more potentially affected by CVE-2026-1605 via org.eclipse.jetty:jetty-server (>=12.1.0, <=12.1.5)

org.eclipse.jetty:jetty-server MAVEN version =12.1.0, =0.1.7, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.5.0, =0.9.0, =0.2.1-alpha, =0.2.1-alpha, =0.6.12 and more Source cves: CVE-2026-1605 Source advisory: GHSA-XXH7-FCF3-RJ7F...

The Eclipse Jetty Server Artifact has a Gzip request memory leak

Description as reported There is a memory leak when using GzipHandler in jetty-12.0.30 that can cause off-heap OOMs. This can be used for DoS attacks so I'm reporting this as a vulnerability. The leak is created by requests where the request is inflated Content-Encoding: gzip and the response is...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3) +1352 more potentially affected by CVE-2026-1605 via org.eclipse.jetty:jetty-server (>=12.1.0, <=12.1.5)

org.eclipse.jetty:jetty-server MAVEN version =12.1.0, =0.1.7, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.5.0, =0.9.0, =0.2.1-alpha, =0.2.1-alpha, =0.6.12 and more Source cves: CVE-2026-1605 Source advisory: OSV:GHSA-XXH7-FCF3-RJ7F...

cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3), cn.herodotus.dante:servlet-message-spring-boot-starter (>=4.0.0.0-m2, <=4.0.0.0-m3) +712 more potentially affected by CVE-2025-11143 via org.eclipse.jetty:jetty-server (>=12.1.0.alpha0, <=12.1.4)

org.eclipse.jetty:jetty-server MAVEN version =12.1.0.alpha0, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.2.1-alpha, =0.2.1-alpha, =4.0.0-1215, =4.0.0-1215, =2.4.2, =2.4.5 - com.github.cafaudit:caf-audit-service-container 5.0.5-1360 and more Source cve...

Interpretation Conflict

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Interpretation Conflict due to inconsistent handling of invalid or unusual URIs in the parse function on HttpURI.java‎. An attacke...

Allocation of Resources Without Limits or Throttling

Overview org.eclipse.jetty:jetty-server is a lightweight highly scalable java based web server and servlet engine. Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the GzipHandler process when handling a compressed HTTP request with...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), cn.herodotus.dante:dante-message-servlet-websocket (>=4.0.0.0-m2, <=4.0.0.0-m3) +1362 more potentially affected by CVE-2026-1605 via org.eclipse.jetty:jetty-server (>=12.1.0.alpha0, <=12.1.5)

org.eclipse.jetty:jetty-server MAVEN version =12.1.0.alpha0, =0.1.7, =4.0.0.0-m2, =4.0.0.0-m2, =7.0.0-m2, =9.0.0, =9.1.0, =9.0.0, =9.1.0, =2.24.0, =21.3.3, =0.5.0, =0.9.0, =0.2.1-alpha, =0.2.1-alpha, =0.6.12 and more Source cves: CVE-2026-1605 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-15426509...

CVE-2026-1605

In Jetty, vulnerable in GzipHandler when processing a gzip-compressed HTTP request (Content-Encoding: gzip) but returning an uncompressed response. A JDK Inflater is allocated to decompress the request, but the release path is tied to the response being compressed; since the response isn’t compre...

Security Bulletin: Jetty HTTP/2 Unvalidated SETTINGS_MAX_HEADER_LIST_SIZE Leads to Out-of-Memory DoS , affects watsonx.data

Summary In Eclipse Jetty versions 12.0.0 to 12.0.16 included, an HTTP/2 client can specify a very large value for the HTTP/2 settings parameter SETTINGSMAXHEADERLISTSIZE. The Jetty HTTP/2 server does not perform validation on this setting, and tries to allocate a ByteBuffer of the specified...

EUVD-2018-0567

Malware in sbrugna...

EUVD-2022-1075

Malicious code in bioql PyPI...

EUVD-2018-0526

Malicious code in bioql PyPI...

BIT-NIFI-2020-27223

In Eclipse Jetty 9.4.6.v20170531 to 9.4.36.v20210114 inclusive, 10.0.0, and 11.0.0 when Jetty handles a request containing multiple Accept headers with a large number of “quality” i.e. q parameters, the server may enter a denial of service DoS state due to high CPU usage processing those quality...

jetty-server: Jetty: Gzip Request Body Buffer Corruption

A flaw was found in Eclipse Jetty. This vulnerability allows corrupted and inadvertent data sharing between requests via a gzip error when inflating a request body. If the request body is malformed, the gzip decompression process can fail, resulting in the application inadvertently using data fro...

UBUNTU-CVE-2025-5115

In Eclipse Jetty, versions =9.4.57, =10.0.25, =11.0.25, =12.0.21, =12.1.0.alpha2, an HTTP/2 client may trigger the server to send RSTSTREAM frames, for example by sending frames that are malformed or that should not be sent in a particular stream state, therefore forcing the server to consume...

jetty-http2-common: Jetty HTTP/2 Header List Size Vulnerability

A flaw was found in Eclipse Jetty. This vulnerability allows denial of service attack via an HTTP/2 client specifying a very large value for the SETTINGSMAXHEADERLISTSIZE parameter...

jetty-server: Jetty: Gzip Request Body Buffer Corruption

A flaw was found in Eclipse Jetty. This vulnerability allows corrupted and inadvertent data sharing between requests via a gzip error when inflating a request body. If the request body is malformed, the gzip decompression process can fail, resulting in the application inadvertently using data fro...

jetty-server: Jetty: Gzip Request Body Buffer Corruption

A flaw was found in Eclipse Jetty. This vulnerability allows corrupted and inadvertent data sharing between requests via a gzip error when inflating a request body. If the request body is malformed, the gzip decompression process can fail, resulting in the application inadvertently using data fro...