ECHO-1dd7-0ea6-3959
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-1dd7-0ea6-3959.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ECHO-1dd7-0ea6-3959
- Upstream
- Withdrawn
- 2026-11-03T21:45:06Z
- Published
- 2026-09-30T11:25:20Z
- Modified
- 2026-11-04T13:15:05Z
- Summary
- Jetty 12-only (GHSA range 12.0.0-12.0.35 / 12.1.0-12.1.9). The leak is the connection-scoped _trailers in Jetty 12's core internal/HttpConnection, which is never reset. 10.0.26 has no such class: trailers live in HttpChannelOverHttp._trailers, and HttpChannelOverHttp.recycle() sets them to null after every request (HttpConnection calls _channel.recycle()). Request.recycle() also clears Request._trailers.
- Details
- References