DEBIAN-CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

DEBIAN-CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

UBUNTU-CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

ai.covia:covia-python-adapter (>=0.8.0, <=0.9.1), ai.covia:covia-sql (>=0.6.0, <=0.9.1) +2289 more potentially affected by CVE-2026-19203 via org.eclipse.jetty:jetty-http (>=12.1.0.alpha0, <=12.1.11)

org.eclipse.jetty:jetty-http MAVEN version =12.1.0.alpha0, =0.8.0, =0.6.0, =0.4.0, =0.4.0, =0.1.7, =4.13.5, =4.9.0, =2.2.3, =3.30.0, =3.30.0, =3.30.0, =3.30.3 and more Source cves: CVE-2026-19203 Source advisory: SNYK:JAVA-ORGECLIPSEJETTY-19644207...

HTTP Request Smuggling

Overview org.eclipse.jetty:jetty-http is an is a http module for jetty server. Affected versions of this package are vulnerable to HTTP Request Smuggling in the chunked request parsing of HttpParser, which accepts a lone LF, rather than CRLF, as the line terminator for chunk extensions, chunk dat...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

EUVD-2026-72733

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-12611

CVE-2026-12611 affects the Eclipse Jetty HTTP/2 server implementation. A client can trigger a race condition in the server's handling of RST_STREAM and GOAWAY frames, which resets HTTP2Flusher.terminated back to null. This allows flusher entries to be enqueued that are never processed, leaving wr...

ai.pipestream:pipestream-wiremock-server (>=0.1.7, <=0.1.8), com.blazemeter.jmeter:jmeter-bzm-http2 (>=3.0.0, <=3.0.1) +756 more potentially affected by CVE-2026-12611 via org.eclipse.jetty.http2:jetty-http2-common (>=12.1.0.alpha0, <=12.1.10)

org.eclipse.jetty.http2:jetty-http2-common MAVEN version =12.1.0.alpha0, =0.1.7, =3.0.0, =8.0.0, =3.0.0, =2.4.2, =1.1.20, =5.0.0, =3.0.0-beta, =4.2.4, =4.2.4, =2.10.0, =0.11.0, =0.2.0, =0.6.0 and more Source cves: CVE-2026-12611 Source advisory: MEND:CVE-2026-12611...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

biz.netcentric.cq.tools.accesscontroltool:sling-maximum-version-environment (>=4.2.0, <=4.2.4), com.atlan:package-toolkit-testing (>=5.3.1, <=7.4.1) +1039 more potentially affected by CVE-2026-12611 via org.eclipse.jetty.http2:jetty-http2-common (>=12.0.0.alpha0, <=12.0.37)

org.eclipse.jetty.http2:jetty-http2-common MAVEN version =12.0.0.alpha0, =4.2.0, =5.3.1, =2.6.0-rc1, =2.0.0, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.217, =0.230 and more Source cves: CVE-2026-12611 Source advisory: MEND:CVE-2026-12611...

CVE-2026-12611

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RSTSTREAM frames and GOAWAY frames...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...

CVE-2026-19203

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of...