GHSA-f4v5-65jj-pcr2

Suggest an improvement
Source
https://github.com/advisories/GHSA-f4v5-65jj-pcr2
Import Source
https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-f4v5-65jj-pcr2/GHSA-f4v5-65jj-pcr2.json
JSON Data
https://api.test.osv.dev/v1/vulns/GHSA-f4v5-65jj-pcr2
Aliases
Downstream
CGA (130)
MINI (40)
Published
2026-07-22T22:56:05Z
Modified
2026-07-22T23:25:38Z
Severity
  • 6.9 (Medium) CVSS_V4 - CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N CVSS Calculator
Summary
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
Details

Description

FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers) HttpConnection._trailers Cross-Request Leakage (Never Reset Between Requests)

Location: jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/ HttpConnection.java:107, 1157-1161, 1170

Detail: _trailers (line 107) is a connection-scoped HttpFields.Mutable field. parsedTrailer() (line 1157) populates it when request N carries HTTP trailers. messageComplete() (line 1170) checks "if (_trailers != null)" — evaluates true from request N's data — and stamps it onto request N+1.

Grep confirms: ZERO occurrences of "_trailers = null" in entire HttpConnection.java.

Scenario: Request N: POST /upload (trailers: X-Checksum: abc123) Request N+1: GET /data (no trailers) app: request.getTrailers() on N+1 → returns {X-Checksum: abc123} ← STALE

Application logic branching on getTrailers() != null produces incorrect behavior. Not cross-connection (same keep-alive connection only).

More dangerous scenario: TOCTOU — trailer passes check, target swapped before use.

Workarounds

Do not rely on HTTP request trailers for security-sensitive logic, or disable persistent connections by closing the connection after each HTTP/1.1 request.

Database specific 
{
    "cwe_ids":  [
        "CWE-200"
    ],
    "github_reviewed":  true,
    "github_reviewed_at":  "2026-07-22T22:56:05Z",
    "nvd_published_at":  "2026-07-14T09:16:39Z",
    "severity":  "MODERATE"
}
References

Affected packages

Maven / org.eclipse.jetty:jetty-server

Package

Name
org.eclipse.jetty:jetty-server
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.0.0
Fixed
12.0.36

Affected versions

12.*
12.0.0
12.0.1
12.0.2
12.0.3
12.0.4
12.0.5
12.0.6
12.0.7
12.0.8
12.0.9
12.0.10
12.0.11
12.0.12
12.0.13
12.0.14
12.0.15
12.0.16
12.0.17
12.0.18
12.0.19
12.0.20
12.0.21
12.0.22
12.0.23
12.0.24
12.0.25
12.0.26
12.0.27
12.0.28
12.0.29
12.0.30
12.0.31
12.0.32
12.0.33
12.0.34
12.0.35

Database specific

last_known_affected_version_range 
"<= 12.0.35"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-f4v5-65jj-pcr2/GHSA-f4v5-65jj-pcr2.json"

Maven / org.eclipse.jetty:jetty-server

Package

Name
org.eclipse.jetty:jetty-server
View open source insights on deps.dev
Purl
pkg:maven/org.eclipse.jetty/jetty-server

Affected ranges

Type
ECOSYSTEM
Events
Introduced
12.1.0
Fixed
12.1.10

Affected versions

12.*
12.1.0
12.1.1
12.1.2
12.1.3
12.1.4
12.1.5
12.1.6
12.1.7
12.1.8
12.1.9

Database specific

last_known_affected_version_range 
"<= 12.1.9"
source 
"https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2026/07/GHSA-f4v5-65jj-pcr2/GHSA-f4v5-65jj-pcr2.json"