Read the docs
TI-2026-01291 Aliases CVE-2026-1605GHSA-xxh7-fcf3-rj7f

Uncontrolled resource consumption in Eclipse Jetty

Priority MEDIUM 40CWE-400Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
None
Attack complexity
Low
Impact type
Denial of service
Confidentiality · integrity · availability
None · None · High
Fix status
Partial Red Hat: 17 fixed, 1 without a fix

Attack profile from CVSS 3.1 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-400.

Summary

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.

Why it matters now

Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00741 54th percentileScored 2026-11-07
Fix Partial org.eclipse.jetty:jetty-server (Maven): 12.1.6, 12.0.32Red Hat: 16 advisoriesRed Hat: 17 fixed, 1 without a fix

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation
None
Automatable
Yes
Technical impact
Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

VendorProductAffected versionsFixed inStatusSource
Eclipse FoundationEclipse Jetty12.0.0 – 12.0.31; 12.1.0. – 12.1.5—No fix listedCNA
—org.eclipse.jetty:jetty-server (Maven)12.1.0 to before 12.1.612.1.6Patch availableGHSA-xxh7-fcf3-rj7f
—org.eclipse.jetty:jetty-server (Maven)12.0.0 to before 12.0.3212.0.32Patch availableGHSA-xxh7-fcf3-rj7f
  • Eclipse Jetty VendorEclipse Foundation Affected 12.0.0 – 12.0.31; 12.1.0. – 12.1.5 Fixed in — No fix listed CNA
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 12.1.0 to before 12.1.6 Fixed in 12.1.6 Patch available GHSA-xxh7-fcf3-rj7f
  • org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 12.0.0 to before 12.0.32 Fixed in 12.0.32 Patch available GHSA-xxh7-fcf3-rj7f

CPE configurations NVD · 1

CPEVersionsRoleVendor
cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:*12.0.0 to before 12.0.32; 12.1.0 to before 12.1.6VulnerableEclipse Foundation
  • cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 12.0.0 to before 12.0.32; 12.1.0 to before 12.1.6 Vulnerable ·Eclipse Foundation

Remediation

  • Fix · GHSA-xxh7-fcf3-rj7f org.eclipse.jetty:jetty-server (Maven) Fixed in 12.1.6 Advisory →
  • Fix · GHSA-xxh7-fcf3-rj7f org.eclipse.jetty:jetty-server (Maven) Fixed in 12.0.32 Advisory →

Red Hat 16 advisories

  • RHSA-2026:60259 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
    • OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60256 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
    • OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60254 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
    • OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 13 more Red Hat advisories
  • RHSA-2026:60252 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
    • OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60251 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
    • OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60250 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
    • OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60249 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
    • OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60248 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
    • OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60247 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
    • OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:60246 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
    • OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
  • RHSA-2026:60239 Released 2026-08-26 · Red Hat rating Important
    Release of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
    • OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
  • RHSA-2026:25125 Released 2026-06-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss EAP 8.1 for RHEL 8 eap8-activemq-artemis-2.40.0-7.redhat_00015.1.el8eap, eap8-activemq-artemis-cli-2.40.0-7.redhat_00015.1.el8eap, eap8-activemq-artemis-commons-2.40.0-7.redhat_00015.1.el8eap +19
    • Red Hat JBoss EAP 8.1 for RHEL 9 eap8-activemq-artemis-2.40.0-7.redhat_00015.1.el9eap, eap8-activemq-artemis-cli-2.40.0-7.redhat_00015.1.el9eap, eap8-activemq-artemis-commons-2.40.0-7.redhat_00015.1.el9eap +19
  • RHSA-2026:25126 Released 2026-06-10 · Red Hat rating Important
    Red Hat JBoss Enterprise Application Platform 8.1.6 security update
    • Red Hat JBoss Enterprise Application Platform 8.1.6 io.undertow.undertow-core-2.3.24.SP2-redhat-00001.jar, org.jboss.activemq.artemis.integration.artemis-wildfly-integration-2.0.3.Final-redhat-00001.jar
  • RHSA-2026:25089 Released 2026-06-10 · Red Hat rating Important
    HawtIO 4.4.0 for Red Hat build of Apache Camel 4 Release and security update.
    • HawtIO HawtIO 4.4.0
  • RHSA-2026:21772 Released 2026-05-28 · Red Hat rating Important
    Red Hat OpenShift Dev Spaces 3.28.0 Release.
    • Red Hat OpenShift Dev Spaces 3.28 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/dashboard-rhel9, registry.redhat.io/devspaces/openvsx-rhel9 +3
  • RHSA-2026:8509 Released 2026-04-16 · Red Hat rating Important
    Red Hat AMQ Broker 7.14.0 release and security update
    • Red Hat AMQ Broker 7.14.0

Vendor assessments

Red Hat

Red Hat rating: Important. Red Hat's page for this CVE →

ProductStatusPlan or fix
OpenShift Developer Tools and ServicesAffectedNo fix yet
HawtIO HawtIO 4.4.0Fixed RHSA-2026:25089
OpenShift Developer Tools and Services 4.12Fixed RHSA-2026:60247
OpenShift Developer Tools and Services 4.13Fixed RHSA-2026:60249
OpenShift Developer Tools and Services 4.14Fixed RHSA-2026:60248
OpenShift Developer Tools and Services 4.15Fixed RHSA-2026:60239
OpenShift Developer Tools and Services 4.16Fixed RHSA-2026:60251
OpenShift Developer Tools and Services 4.17Fixed RHSA-2026:60246
OpenShift Developer Tools and Services 4.18Fixed RHSA-2026:60250
OpenShift Developer Tools and Services 4.19Fixed RHSA-2026:60252
OpenShift Developer Tools and Services 4.20Fixed RHSA-2026:60259
OpenShift Developer Tools and Services 4.21Fixed RHSA-2026:60254
OpenShift Developer Tools and Services 4.22Fixed RHSA-2026:60256
Red Hat AMQ Broker 7.14.0Fixed RHSA-2026:8509
Red Hat JBoss EAP 8.1 for RHEL 8Fixed RHSA-2026:25125
Red Hat JBoss EAP 8.1 for RHEL 9Fixed RHSA-2026:25125
Red Hat JBoss Enterprise Application Platform 8.1.6Fixed RHSA-2026:25126
Red Hat OpenShift Dev Spaces 3.28Fixed RHSA-2026:21772
Not affected: 32 products
  • OpenShift Developer Tools and Services 4.12
  • OpenShift Developer Tools and Services 4.13
  • OpenShift Developer Tools and Services 4.14
  • OpenShift Developer Tools and Services 4.15
  • OpenShift Developer Tools and Services 4.16
  • OpenShift Developer Tools and Services 4.17
  • OpenShift Developer Tools and Services 4.18
  • OpenShift Developer Tools and Services 4.19
  • OpenShift Developer Tools and Services 4.20
  • OpenShift Developer Tools and Services 4.21
  • OpenShift Developer Tools and Services 4.22
  • Red Hat Data Grid 8
  • Red Hat Enterprise Linux 7
  • Red Hat Enterprise Linux 8
  • Red Hat Enterprise Linux 9
  • Red Hat Fuse 7
  • Red Hat JBoss Enterprise Application Platform 7
  • Red Hat JBoss Enterprise Application Platform 8.1.6
  • Red Hat JBoss Enterprise Application Platform Expansion Pack
  • Red Hat JBoss Web Server 6
  • Red Hat Offline Knowledge Portal
  • Red Hat OpenShift Dev Spaces 3.28
  • Red Hat Process Automation 7
  • Red Hat Satellite 6
  • Red Hat Single Sign-On 7
  • Red Hat build of Apache Camel for Spring Boot 4
  • Red Hat build of Apicurio Registry 2
  • Red Hat build of Apicurio Registry 3
  • Red Hat build of Debezium 2
  • Red Hat build of Debezium 3
  • streams for Apache Kafka 2
  • streams for Apache Kafka 3

Timeline

  1. 2026-10-02 Threatist record created from CVE-2026-1605
  2. 2026-10-03 Alias added: GHSA-xxh7-fcf3-rj7f
  3. 2026-10-09 Fix available: RHSA-2026:8509 · Red Hat
  4. 2026-10-10 Fix available: Red Hat AMQ Broker 7.14.0 · Red Hat
  5. 2026-10-16 Fix available: Red Hat JBoss Enterprise Application Platform 8.1.6 · Red Hat

References

Advisory 2

Other 3

  • TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
  • TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
  • TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
  • TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
  • TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
  • TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
See all 51 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences