ECHO-7ace-751a-c022
See a problem?- Import Source
- https://advisory.echohq.com/osv/ECHO-7ace-751a-c022.json
- JSON Data
- https://api.test.osv.dev/v1/vulns/ECHO-7ace-751a-c022
- Upstream
- Withdrawn
- 2026-11-03T21:45:06Z
- Published
- 2026-09-30T11:25:20Z
- Modified
- 2026-11-04T13:15:05Z
- Summary
- Jetty 12-only (GHSA range 12.0.0-12.0.31 / 12.1.0-12.1.5). The leaking code is Jetty 12's GzipHandler/GzipRequest, where GzipRequest.destroy() (which returns the Inflater to the pool) only ran through GzipResponseAndCallback when the response was also deflated. In 10.0.26, request inflation is a GzipHttpInputInterceptor (implements Destroyable) installed on HttpInput. AsyncContentProducer.recycle() destroys it after every request, whether or not the response is deflated.
- Details
- References