CVE-2026-1605

See a problem?
Please try reporting it to the source first.
Source
https://cve.org/CVERecord?id=CVE-2026-1605
Import Source
https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-1605.json
JSON Data
https://api.test.osv.dev/v1/vulns/CVE-2026-1605
Aliases
Downstream
Related
Published
2026-03-05T10:15:56.890Z
Modified
2026-03-09T23:53:09.876233Z
Severity
  • 7.5 (High) CVSS_V3 - CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H CVSS Calculator
Summary
[none]
Details

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.

This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.

References

Affected packages

Git / github.com/eclipse/jetty.project

Affected ranges

Type
GIT
Repo
https://github.com/eclipse/jetty.project
Events
Introduced
28100e8da711e44c0722ed10bd413ae862497539
Fixed
f13f7f3ceda880938728d2378d201a661f2a9204
Introduced
c8372b65bd15404de1444d68902c0455a3a69b64
Fixed
88ca559572b1c8858b3c5684bb0293fa64e5e90f
Database specific 
{
    "versions": [
        {
            "introduced": "12.0.0"
        },
        {
            "fixed": "12.0.32"
        },
        {
            "introduced": "12.1.0"
        },
        {
            "fixed": "12.1.6"
        }
    ]
}

Affected versions

jetty-10.*
jetty-10.0.16
jetty-10.0.17
jetty-10.0.18
jetty-10.0.19
jetty-10.0.20
jetty-10.0.22
jetty-10.0.23
jetty-10.0.24
jetty-11.*
jetty-11.0.16
jetty-11.0.17
jetty-11.0.18
jetty-11.0.19
jetty-11.0.20
jetty-11.0.22
jetty-11.0.23
jetty-11.0.24
jetty-12.*
jetty-12.0.0x
jetty-12.0.1
jetty-12.0.10
jetty-12.0.11
jetty-12.0.12
jetty-12.0.13
jetty-12.0.14
jetty-12.0.15
jetty-12.0.16
jetty-12.0.17
jetty-12.0.18
jetty-12.0.19
jetty-12.0.2
jetty-12.0.20
jetty-12.0.22
jetty-12.0.23
jetty-12.0.28
jetty-12.0.29
jetty-12.0.3
jetty-12.0.30
jetty-12.0.31
jetty-12.0.4
jetty-12.0.5
jetty-12.0.6
jetty-12.0.7
jetty-12.0.8
jetty-12.0.9
jetty-12.1.0
jetty-12.1.0.alpha0
jetty-12.1.0.beta1
jetty-12.1.2
jetty-12.1.3
jetty-12.1.4
jetty-12.1.5

Database specific

source 
"https://storage.googleapis.com/osv-test-cve-osv-conversion/osv-output/CVE-2026-1605.json"