{"id":"CVE-2026-1605","aliases":["DEBIAN-CVE-2026-1605","EUVD-2026-9815","GHSA-xxh7-fcf3-rj7f","RHSA-2026:25125","ROOT-APP-MAVEN-CVE-2026-1605","UBUNTU-CVE-2026-1605"],"status":"published","title":"The Eclipse Jetty Server Artifact has a Gzip request memory leak","description":"In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.\n\n\nThis happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.\nIn this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.","severity":{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-10","score":0.00741,"percentile":0.54973,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-400","CWE-401","CWE-772"],"published":"2026-03-05T09:39:01Z","modified":"2026-10-28T02:31:06Z","fixes":[{"ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["12.1.6","12.0.32"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:14","package":"jetty12","fixed_in":["12.0.32-1"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-server","fixed_in":["12.0.17-aikido.1","12.0.13-aikido.7","12.0.3-aikido.7","12.0.13-aikido.8","12.0.13-aikido.9","12.0.16-aikido.4","12.0.3-aikido.8","12.0.13-aikido.10","12.0.16-aikido.5","12.0.3-aikido.9"],"sources":["osv"]},{"ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-server","fixed_in":["12.0.17-root.io.1","12.0.3-root.io.3","12.0.13-root.io.6","12.0.16-root.io.2","12.0.3-root.io.4","12.0.3-root.io.5","12.0.3-root.io.6","12.0.13-root.io.7","12.0.3-root.io.7","12.0.16-root.io.3","12.0.13-root.io.8","12.0.13-root.io.9","12.0.16-root.io.4","12.0.3-root.io.8","12.0.13-root.io.10","12.0.16-root.io.5","12.0.3-root.io.9"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"last_affected":"12.1.5"},{"fixed":"12.1.6"}]}]},{"source":"ghsa","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"last_affected":"12.0.31"},{"fixed":"12.0.32"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1","12.0.32-1","12.0.32-2","12.0.33-1","12.0.39-1"]},{"source":"osv","ecosystem":"Debian:14","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.32-1"}]}],"versions":["12.0.17-3","12.0.17-3.1","12.0.17-3.1~deb13u1"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.1.0"},{"fixed":"12.1.6"}]}],"versions":["12.1.0","12.1.1","12.1.2","12.1.3","12.1.4","12.1.5"]},{"source":"osv","ecosystem":"Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"12.0.0"},{"fixed":"12.0.32"}]}],"versions":["12.0.0","12.0.1","12.0.10","12.0.11","12.0.12","12.0.13","12.0.14","12.0.15","12.0.16","12.0.17","12.0.18","12.0.19","12.0.2","12.0.20","12.0.21","12.0.22","12.0.23","12.0.24","12.0.25","12.0.26","12.0.27","12.0.28","12.0.29","12.0.3","12.0.30","12.0.31","12.0.4","12.0.5","12.0.6","12.0.7","12.0.8","12.0.9"]},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-dto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-hornetq-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-hqclient-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jakarta-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jakarta-ra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jakarta-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jakarta-service-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-jdbc-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-journal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-selector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-activemq-artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:801.6.1-1.GA_redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:801.6.1-1.GA_redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.24-3.SP2_redhat_00001.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-7.GA_redhat_00010.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-7.GA_redhat_00010.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-7.GA_redhat_00010.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el8","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-7.GA_redhat_00010.1.el8eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-commons","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-core-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-dto","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-hornetq-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-hqclient-protocol","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jakarta-client","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jakarta-ra","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jakarta-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jakarta-service-extensions","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-jdbc-store","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-journal","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-selector","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-activemq-artemis-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.40.0-7.redhat_00015.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-eap-product-conf-parent","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:801.6.1-1.GA_redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-eap-product-conf-wildfly-ee-feature-pack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:801.6.1-1.GA_redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-undertow","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.3.24-3.SP2_redhat_00001.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-7.GA_redhat_00010.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-java-jdk17","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-7.GA_redhat_00010.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-java-jdk21","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-7.GA_redhat_00010.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Red Hat:jboss_enterprise_application_platform:8.1::el9","package":"eap8-wildfly-modules","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:8.1.6-7.GA_redhat_00010.1.el9eap"}]}],"bundled":4},{"source":"osv","ecosystem":"Root:Maven","package":"org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-aikido.1"},{"fixed":"12.0.13-aikido.7"},{"fixed":"12.0.3-aikido.7"},{"fixed":"12.0.13-aikido.8"},{"fixed":"12.0.13-aikido.9"},{"fixed":"12.0.16-aikido.4"},{"fixed":"12.0.3-aikido.8"},{"fixed":"12.0.13-aikido.10"},{"fixed":"12.0.16-aikido.5"},{"fixed":"12.0.3-aikido.9"}]}]},{"source":"osv","ecosystem":"Root:Maven","package":"io.root.org.eclipse.jetty:jetty-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"12.0.17-root.io.1"},{"fixed":"12.0.3-root.io.3"},{"fixed":"12.0.13-root.io.6"},{"fixed":"12.0.16-root.io.2"},{"fixed":"12.0.3-root.io.4"},{"fixed":"12.0.3-root.io.5"},{"fixed":"12.0.3-root.io.6"},{"fixed":"12.0.13-root.io.7"},{"fixed":"12.0.3-root.io.7"},{"fixed":"12.0.16-root.io.3"},{"fixed":"12.0.13-root.io.8"},{"fixed":"12.0.13-root.io.9"},{"fixed":"12.0.16-root.io.4"},{"fixed":"12.0.3-root.io.8"},{"fixed":"12.0.13-root.io.10"},{"fixed":"12.0.16-root.io.5"},{"fixed":"12.0.3-root.io.9"}]}]},{"source":"osv","ecosystem":"Ubuntu:16.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.14-1"]},{"source":"osv","ecosystem":"Ubuntu:18.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.2.22-2","9.2.22-3","9.2.23-1","9.4.15-1~18.04.1ubuntu1"]},{"source":"osv","ecosystem":"Ubuntu:20.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.18-2build2","9.4.26-1"]},{"source":"osv","ecosystem":"Ubuntu:22.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.39-3","9.4.44-2","9.4.44-3","9.4.44-4","9.4.45-1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.51-2","9.4.53-1"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.56-1","9.4.57-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.58-1","9.4.58-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty12","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["12.0.17-3.1","12.0.32-1"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"jetty9","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["9.4.57-1","9.4.57-1.1","9.4.58-1"]}],"products":[{"vendor":"eclipse","product":"jetty"},{"vendor":"eclipse foundation","product":"eclipse jetty"},{"vendor":"red hat","product":"hawtio hawtio 4.4.0"},{"vendor":"red hat","product":"openshift developer tools and services"},{"vendor":"red hat","product":"openshift developer tools and services 4.12"},{"vendor":"red hat","product":"openshift developer tools and services 4.13"},{"vendor":"red hat","product":"openshift developer tools and services 4.14"},{"vendor":"red hat","product":"openshift developer tools and services 4.15"},{"vendor":"red hat","product":"openshift developer tools and services 4.16"},{"vendor":"red hat","product":"openshift developer tools and services 4.17"},{"vendor":"red hat","product":"openshift developer tools and services 4.18"},{"vendor":"red hat","product":"openshift developer tools and services 4.19"},{"vendor":"red hat","product":"openshift developer tools and services 4.20"},{"vendor":"red hat","product":"openshift developer tools and services 4.21"},{"vendor":"red hat","product":"openshift developer tools and services 4.22"},{"vendor":"red hat","product":"red hat amq broker 7.14.0"},{"vendor":"red hat","product":"red hat build of apache camel for spring boot 4"},{"vendor":"red hat","product":"red hat build of apicurio registry 2"},{"vendor":"red hat","product":"red hat build of apicurio registry 3"},{"vendor":"red hat","product":"red hat build of debezium 2"},{"vendor":"red hat","product":"red hat build of debezium 3"},{"vendor":"red hat","product":"red hat data grid 8"},{"vendor":"red hat","product":"red hat enterprise linux 7"},{"vendor":"red hat","product":"red hat enterprise linux 8"},{"vendor":"red hat","product":"red hat enterprise linux 9"},{"vendor":"red hat","product":"red hat fuse 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 7"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.1"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.1 for rhel 8"},{"vendor":"red hat","product":"red hat jboss enterprise application platform 8.1 for rhel 9"},{"vendor":"red hat","product":"red hat jboss enterprise application platform expansion pack"},{"vendor":"red hat","product":"red hat jboss web server 6"},{"vendor":"red hat","product":"red hat offline knowledge portal"},{"vendor":"red hat","product":"red hat openshift dev spaces 3.28"},{"vendor":"red hat","product":"red hat process automation 7"},{"vendor":"red hat","product":"red hat satellite 6"},{"vendor":"red hat","product":"red hat single sign-on 7"},{"vendor":"red hat","product":"streams for apache kafka 2"},{"vendor":"red hat","product":"streams for apache kafka 3"}],"references":[{"url":"https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f","tags":["Vendor Advisory","advisory","web","article","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-1605","tags":["vdb-entry","x_refsource_REDHAT","advisory","report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2444815","tags":["issue-tracking","x_refsource_REDHAT","report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/vex/2026/cve-2026-1605.json","tags":["x_sadp-csaf-vex","web"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25125","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25089","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60247","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60249","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60248","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60239","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60251","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60246","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60250","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60252","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60259","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60254","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:60256","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:8509","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:25126","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","tags":["vendor-advisory","x_refsource_REDHAT","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-1605","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project/issues/14260","tags":["web"]},{"url":"https://gitlab.eclipse.org/security/cve-assignment/-/issues/79","tags":["web"]},{"url":"https://github.com/advisories/GHSA-xxh7-fcf3-rj7f"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/1xxx/CVE-2026-1605.json","tags":["advisory"]},{"url":"https://github.com/jetty/jetty.project","tags":["package"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2026-1605","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1","tags":["article"]},{"url":"https://docs.redhat.com/en/documentation/red_hat_jboss_enterprise_application_platform/8.1/html/release_notes_for_red_hat_jboss_enterprise_application_platform_8.1/index","tags":["article"]},{"url":"https://access.redhat.com/articles/7137768","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2443260","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2443261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2443262","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2026/rhsa-2026_25125.json","tags":["advisory"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-1605","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28367","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28367","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28367","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28368","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28368","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28368","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2026-28369","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2026-28369","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2026-28369","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2026-1605","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2026-1605","description":"In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.\n\n\nThis happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.\nIn this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.","status":"published","published":"2026-03-05T09:39:01.315Z","modified":"2026-09-14T12:04:23.826Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"cna"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"adp"}],"cwes":["CWE-400","CWE-401","CWE-772"],"updated_at":"2026-11-02T14:20:00.879257Z"}],"euvd":[{"id":"EUVD-2026-9815","description":"In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.\n\n\nThis happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.\nIn this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.","status":"published","published":"2026-03-05T09:39:01Z","modified":"2026-09-14T12:04:23Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T17:28:21.2136Z"}],"ghsa":[{"id":"GHSA-xxh7-fcf3-rj7f","title":"The Eclipse Jetty Server Artifact has a Gzip request memory leak ","description":"### Description (as reported)\n\nThere is a memory leak when using `GzipHandler` in jetty-12.0.30 that can cause off-heap OOMs. This can be used for DoS attacks so I'm reporting this as a vulnerability.\n\nThe leak is created by requests where the request is inflated (`Content-Encoding: gzip`) and the response is not deflated (no `Accept-Encoding: gzip`). In these conditions, a new inflator will be created by `GzipRequest` and never released back into `GzipRequest.__inflaterPool` because `gzipRequest.destory()` is not called.\n\nIn heap dumps one can see thousands of `java.util.zip.Inflator` objects, which use both Java heaps and native memory. Leaking native memory causes of off-heap OOMs.\n\nCode path in `GzipHandler.handle()`:\n1. Line 601: `GzipRequest` is created when request inflation is needed.\n2. Lines 611-616: The callback is only wrapped in `GzipResponseAndCallback` when both inflation and deflation are needed.\n3. Lines 619-625: If the handler accepts the request (returns true), `gzipRequest.destroy()` is only called in the \"request not accepted\" path (returns false)\n\nWhen deflation is needed, `GzipResponseAndCallback` (lines 102 and 116) properly calls `gzipRequest.destroy()` in its `succeeded()` and `failed()` methods. But this wrapper is only created when deflation is needed.\n\nPossible fix:\nThe callback should be wrapped whenever a `GzipRequest` is created, not just when deflation is needed. This ensures `gzipRequest.destroy()` is always called when the request completes.\n\n\n### Impact\nThe leak causes the JVM to crash with OOME.\n\n### Patches\nNo patches yet.\n\n### Workarounds\nDisable `GzipHandler`.\n\n### References\nhttps://github.com/jetty/jetty.project/issues/14260\n\nhttps://gitlab.eclipse.org/security/cve-assignment/-/issues/79","status":"published","published":"2026-03-05T21:27:59Z","modified":"2026-03-06T22:52:39Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T14:39:32.329372Z"}],"nvd":[{"id":"CVE-2026-1605","description":"In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.\n\n\nThis happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.\nIn this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.","status":"published","published":"2026-03-05T10:15:56.89Z","modified":"2026-08-27T13:16:57.52Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high","assessor":"secondary"}],"cwes":["CWE-400","CWE-401","CWE-772"],"updated_at":"2026-11-02T14:12:07.852448Z"}],"osv":[{"id":"CVE-2026-1605","description":"In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.\n\n\nThis happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.\nIn this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.","status":"published","published":"2026-03-05T09:39:01.315Z","modified":"2026-10-28T02:31:06.524141673Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T15:44:57.682091Z"},{"id":"DEBIAN-CVE-2026-1605","description":"In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.   This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.","status":"published","published":"2026-03-05T10:15:56.89Z","modified":"2026-10-01T03:02:26.284440829Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:45:52.562592Z"},{"id":"GHSA-xxh7-fcf3-rj7f","title":"The Eclipse Jetty Server Artifact has a Gzip request memory leak ","description":"### Description (as reported)\n\nThere is a memory leak when using `GzipHandler` in jetty-12.0.30 that can cause off-heap OOMs. This can be used for DoS attacks so I'm reporting this as a vulnerability.\n\nThe leak is created by requests where the request is inflated (`Content-Encoding: gzip`) and the response is not deflated (no `Accept-Encoding: gzip`). In these conditions, a new inflator will be created by `GzipRequest` and never released back into `GzipRequest.__inflaterPool` because `gzipRequest.destory()` is not called.\n\nIn heap dumps one can see thousands of `java.util.zip.Inflator` objects, which use both Java heaps and native memory. Leaking native memory causes of off-heap OOMs.\n\nCode path in `GzipHandler.handle()`:\n1. Line 601: `GzipRequest` is created when request inflation is needed.\n2. Lines 611-616: The callback is only wrapped in `GzipResponseAndCallback` when both inflation and deflation are needed.\n3. Lines 619-625: If the handler accepts the request (returns true), `gzipRequest.destroy()` is only called in the \"request not accepted\" path (returns false)\n\nWhen deflation is needed, `GzipResponseAndCallback` (lines 102 and 116) properly calls `gzipRequest.destroy()` in its `succeeded()` and `failed()` methods. But this wrapper is only created when deflation is needed.\n\nPossible fix:\nThe callback should be wrapped whenever a `GzipRequest` is created, not just when deflation is needed. This ensures `gzipRequest.destroy()` is always called when the request completes.\n\n\n### Impact\nThe leak causes the JVM to crash with OOME.\n\n### Patches\nNo patches yet.\n\n### Workarounds\nDisable `GzipHandler`.\n\n### References\nhttps://github.com/jetty/jetty.project/issues/14260\n\nhttps://gitlab.eclipse.org/security/cve-assignment/-/issues/79","status":"published","published":"2026-03-05T21:27:59Z","modified":"2026-09-10T03:50:41.955076296Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"cwes":["CWE-400","CWE-401"],"updated_at":"2026-11-02T15:47:00.604718Z"},{"id":"RHSA-2026:25125","title":"Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update","status":"published","published":"2026-06-11T10:09:19Z","modified":"2026-10-15T10:15:42Z","cvss":[{"version":"3.1","score":8.7,"vector":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:H/A:N","level":"high"}],"updated_at":"2026-11-02T15:53:19.449341Z"},{"id":"ROOT-APP-MAVEN-CVE-2026-1605","title":"CVE-2026-1605 in org.eclipse.jetty:jetty-server - Patched by Root","description":"Root has patched CVE-2026-1605 in the org.eclipse.jetty:jetty-server package for Root:Maven. Multiple fixed versions available.","status":"published","published":"2026-09-16T16:58:12Z","modified":"2026-09-16T17:15:03.147127517Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T15:53:27.066589Z"},{"id":"UBUNTU-CVE-2026-1605","description":"In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.","status":"published","published":"2026-03-05T10:15:00Z","modified":"2026-10-17T12:59:53.220483603Z","cvss":[{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"},{"version":"3.1","score":7.5,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H","level":"high"}],"updated_at":"2026-11-02T16:56:00.592716Z"}]}}