Skip to content
Fencer Vulns
high 7.5

CVE-2026-1605 json

The Eclipse Jetty Server Artifact has a Gzip request memory leak

published 2026-03-05 8 mo ago modified 2026-09-14 55 d ago also EUVD-2026-9815 , GHSA-xxh7-fcf3-rj7f

cvss
7.5
version 3.1, CNA
cisa kev
Not listed
not in CISA's catalog
epss
0.7%
EPSS 0.7% chance of exploitation in 30 days, percentile 54%
public exploits
0
none known

Summary

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.

This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.

Patch / fix

  • maven org.eclipse.jetty:jetty-server 12.0.32, 12.1.6
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 0:2.3.24-3.SP2_redhat_00001.1.el8eap, 0:2.40.0-7.redhat_00015.1.el8eap, 0:8.1.6-7.GA_redhat_00010.1.el8eap, 0:801.6.1-1.GA_redhat_00001.1.el8eap
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 0:2.3.24-3.SP2_redhat_00001.1.el9eap, 0:2.40.0-7.redhat_00015.1.el9eap, 0:8.1.6-7.GA_redhat_00010.1.el9eap, 0:801.6.1-1.GA_redhat_00001.1.el9eap
  • Red Hat OpenShift Developer Tools and Services 4.12 1786628667
  • Red Hat OpenShift Developer Tools and Services 4.13 1786628681
  • Red Hat OpenShift Developer Tools and Services 4.14 1786533561
  • Red Hat OpenShift Developer Tools and Services 4.15 1786533565
  • Red Hat OpenShift Developer Tools and Services 4.16 1787125166
  • Red Hat OpenShift Developer Tools and Services 4.17 1787124635
  • Red Hat OpenShift Developer Tools and Services 4.18 1787125069
  • Red Hat OpenShift Developer Tools and Services 4.19 1787124632
  • Red Hat OpenShift Developer Tools and Services 4.20 1787124925
  • Red Hat OpenShift Developer Tools and Services 4.21 1787125311
  • Red Hat OpenShift Developer Tools and Services 4.22 1787124779
  • Red Hat Red Hat OpenShift Dev Spaces 3.28 1779359423, 1779528224
  • jetty12 Debian 14 12.0.32-1

debian advisories DEBIAN-CVE-2026-1605

  • eap8-wildfly jboss enterprise application platform 8.1 8.1.6-7.GA_redhat_00010.1.el8eap
  • eap8-wildfly jboss enterprise application platform 8.1 8.1.6-7.GA_redhat_00010.1.el9eap
  • eap8-undertow jboss enterprise application platform 8.1 2.3.24-3.SP2_redhat_00001.1.el8eap
  • eap8-undertow jboss enterprise application platform 8.1 2.3.24-3.SP2_redhat_00001.1.el9eap
  • eap8-wildfly-modules jboss enterprise application platform 8.1 8.1.6-7.GA_redhat_00010.1.el8eap
  • eap8-wildfly-modules jboss enterprise application platform 8.1 8.1.6-7.GA_redhat_00010.1.el9eap
  • eap8-activemq-artemis jboss enterprise application platform 8.1 2.40.0-7.redhat_00015.1.el8eap
  • eap8-activemq-artemis jboss enterprise application platform 8.1 2.40.0-7.redhat_00015.1.el9eap

red hat advisories RHSA-2026:25125

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2026-1605 updated cvss 7.5

org.eclipse.jetty/jetty-server: Eclipse Jetty: Denial of Service due to unreleased JDK Inflater from compressed HTTP requests

  • Red Hat OpenShift Developer Tools and Services jenkins
    affected: workaround, no fix available
  • Red Hat HawtIO HawtIO 4.4.0
    fixed: vendor fix RHSA-2026:25089
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-rhel8 1786628667
    fixed: vendor fix RHSA-2026:60247
  • Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-rhel8 1786628681
    fixed: vendor fix RHSA-2026:60249
  • Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-rhel8 1786533561
    fixed: vendor fix RHSA-2026:60248
  • Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-rhel8 1786533565
    fixed: vendor fix RHSA-2026:60239
  • Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-rhel9 1787125166
    fixed: vendor fix RHSA-2026:60251
  • Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-rhel9 1787124635
    fixed: vendor fix RHSA-2026:60246
show 12 more
  • Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-rhel9 1787125069
    fixed: vendor fix RHSA-2026:60250
  • Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-rhel9 1787124632
    fixed: vendor fix RHSA-2026:60252
  • Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-rhel9 1787124925
    fixed: vendor fix RHSA-2026:60259
  • Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-rhel9 1787125311
    fixed: vendor fix RHSA-2026:60254
  • Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-rhel9 1787124779
    fixed: vendor fix RHSA-2026:60256
  • Red Hat AMQ Broker 7.14.0
    fixed: vendor fix RHSA-2026:8509
  • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-wildfly 8.1.6-7.GA_redhat_00010.1.el8eap, eap8-undertow 2.3.24-3.SP2_redhat_00001.1.el8eap, eap8-activemq-artemis 2.40.0-7.redhat_00015.1.el8eap, eap8-wildfly-modules 8.1.6-7.GA_redhat_00010.1.el8eap, eap8-activemq-artemis-cli 2.40.0-7.redhat_00015.1.el8eap, eap8-activemq-artemis-dto 2.40.0-7.redhat_00015.1.el8eap, +16 more Red Hat JBoss EAP 8.1 for RHEL 9 eap8-wildfly 8.1.6-7.GA_redhat_00010.1.el9eap, eap8-undertow 2.3.24-3.SP2_redhat_00001.1.el9eap, eap8-activemq-artemis 2.40.0-7.redhat_00015.1.el9eap, eap8-wildfly-modules 8.1.6-7.GA_redhat_00010.1.el9eap, eap8-activemq-artemis-cli 2.40.0-7.redhat_00015.1.el9eap, eap8-activemq-artemis-dto 2.40.0-7.redhat_00015.1.el9eap, +16 more
    fixed: vendor fix RHSA-2026:25125
  • Red Hat JBoss Enterprise Application Platform 8.1.6 artemis-wildfly-integration 2.0.3.Final-redhat-00001
    fixed: vendor fix RHSA-2026:25126
  • Red Hat OpenShift Dev Spaces 3.28 devspaces/openvsx-rhel9 1779528224, devspaces/pluginregistry-rhel9 1779359423
    fixed: vendor fix RHSA-2026:21772
  • Red Hat OpenShift Developer Tools and Services 4.12 ocp-tools-4/jenkins-agent-base-rhel8 1786628706 Red Hat OpenShift Developer Tools and Services 4.13 ocp-tools-4/jenkins-agent-base-rhel8 1786628711 Red Hat OpenShift Developer Tools and Services 4.14 ocp-tools-4/jenkins-agent-base-rhel8 1786628748 Red Hat OpenShift Developer Tools and Services 4.15 ocp-tools-4/jenkins-agent-base-rhel8 1786628726 Red Hat OpenShift Developer Tools and Services 4.16 ocp-tools-4/jenkins-agent-base-rhel9 1787124634 Red Hat OpenShift Developer Tools and Services 4.17 ocp-tools-4/jenkins-agent-base-rhel9 1787124986
    +5 more products
    Red Hat OpenShift Developer Tools and Services 4.18 ocp-tools-4/jenkins-agent-base-rhel9 1787124633 Red Hat OpenShift Developer Tools and Services 4.19 ocp-tools-4/jenkins-agent-base-rhel9 1787124663 Red Hat OpenShift Developer Tools and Services 4.20 ocp-tools-4/jenkins-agent-base-rhel9 1787125493 Red Hat OpenShift Developer Tools and Services 4.21 ocp-tools-4/jenkins-agent-base-rhel9 1787125679 Red Hat OpenShift Developer Tools and Services 4.22 ocp-tools-4/jenkins-agent-base-rhel9 1787125563
    not affected: vulnerable code not present
  • Red Hat build of Apache Camel for Spring Boot 4 jetty-server
    not affected: inline mitigations already exist
  • Red Hat build of Apicurio Registry 2 jetty-server Red Hat build of Apicurio Registry 3 jetty-server Red Hat build of Debezium 2 jetty-server Red Hat build of Debezium 3 jetty-server Red Hat Data Grid 8 jetty-server Red Hat Enterprise Linux 7 maven-wagon, maven-wagon-scm, maven-wagon-javadoc, maven-wagon-provider-test
    +4 more products
    Red Hat Enterprise Linux 8 resteasy, resteasy-javadoc Red Hat Enterprise Linux 9 jmc, resteasy, pki-resteasy-core, pki-resteasy-client, pki-resteasy-jackson2-provider, pki-resteasy-servlet-initializer Red Hat Fuse 7 jetty-server Red Hat JBoss Enterprise Application Platform 7 jetty-server
    not affected: vulnerable code not present

10 more not affected in the full advisory

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

CISA SSVC

Exploitation
none
Automatable
yes
Technical impact
partial
Assessed
8 mo ago

Exploit prediction

0.74% chance of exploitation in the next 30 days, higher than 54% of all scored CVEs (FIRST EPSS, 2026-11-08).

CVSS scores

assigned by version score vector
CNA 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
CISA ADP 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
GitHub 3.1 7.5 CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Affected packages

ecosystem package affected fixed in
maven org.eclipse.jetty:jetty-server
>=12.1.0, <12.1.6
>=12.0.0, <12.0.32
12.1.6
12.0.32

Affected products

  • Eclipse Foundation Eclipse Jetty
  • Red Hat HawtIO HawtIO 4.4.0
  • Red Hat Red Hat AMQ Broker 7.14.0
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8
  • Red Hat Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9
  • Red Hat OpenShift Developer Tools and Services 4.12
  • Red Hat OpenShift Developer Tools and Services 4.13
  • Red Hat OpenShift Developer Tools and Services 4.14
  • Red Hat OpenShift Developer Tools and Services 4.15
  • Red Hat OpenShift Developer Tools and Services 4.16
  • Red Hat OpenShift Developer Tools and Services 4.17
  • Red Hat OpenShift Developer Tools and Services 4.18
  • Red Hat OpenShift Developer Tools and Services 4.19
  • Red Hat OpenShift Developer Tools and Services 4.20
  • Red Hat OpenShift Developer Tools and Services 4.21
  • Red Hat OpenShift Developer Tools and Services 4.22
  • Red Hat Red Hat OpenShift Dev Spaces 3.28
  • Red Hat OpenShift Developer Tools and Services
  • Red Hat Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat Red Hat build of Apicurio Registry 2
  • Red Hat Red Hat build of Apicurio Registry 3
  • Red Hat Red Hat build of Debezium 2
  • Red Hat Red Hat build of Debezium 3
  • Red Hat Red Hat Data Grid 8
  • Red Hat Red Hat Enterprise Linux 7
  • Red Hat Red Hat Enterprise Linux 8
  • Red Hat Red Hat Enterprise Linux 9
  • Red Hat Red Hat Fuse 7
  • Red Hat Red Hat JBoss Enterprise Application Platform 7
  • Red Hat Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat Red Hat JBoss Web Server 6
  • Red Hat Red Hat Offline Knowledge Portal
  • Red Hat Red Hat Process Automation 7
  • Red Hat Red Hat Satellite 6
  • Red Hat Red Hat Single Sign-On 7
  • Red Hat streams for Apache Kafka 2
  • Red Hat streams for Apache Kafka 3

Classification

Weakness
  • CWE-400 Uncontrolled Resource Consumption
  • CWE-401 Missing Release of Memory after Effective Lifetime
  • CWE-772 Missing Release of Resource after Effective Lifetime
Technology feeds

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.

CPEs and fixed versions use Anchore's correction of NVD's data: Added CPE configurations because not yet analyzed by NVD.