Information disclosure in Eclipse Jetty
Priority LOW 37CWE-200Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- None
- Attack complexity
- Low
- Attack requirements
- None
- Impact type
- Information disclosure
- Confidentiality · integrity · availability
- Low · None · None
- Fix status
- Partial Red Hat: 23 fixed, 5 without a fix
Attack profile from CVSS 4.0 · CNA. Fix status from CNA, GitHub and Red Hat. Impact type from CWE-200.
Summary
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.
Why it matters now
Exploitation None reported CISA SSVC · not in CISA KEV
EPSS 0.00429 37th percentileScored 2026-11-07
Public exploit Yes 1 exploit referenceTagged by NVD
Fix Partial org.eclipse.jetty:jetty-server (Maven): 12.0.36, 12.1.10Red Hat: 22 advisoriesRed Hat: 23 fixed, 5 without a fix
SSVC decision points
CISA ADP · SSVC 2.0.3
- Exploitation
- None
- Automatable
- Yes
- Technical impact
- Partial
The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | 12.0.0 – 12.0.35; 12.1.0 – 12.1.9 | — | No fix listed | CNA |
| — | org.eclipse.jetty:jetty-server (Maven) | 12.0.0 to before 12.0.36 | 12.0.36 | Patch available | GHSA-f4v5-65jj-pcr2 |
| — | org.eclipse.jetty:jetty-server (Maven) | 12.1.0 to before 12.1.10 | 12.1.10 | Patch available | GHSA-f4v5-65jj-pcr2 |
- Eclipse Jetty VendorEclipse Foundation Affected 12.0.0 – 12.0.35; 12.1.0 – 12.1.9 Fixed in — No fix listed CNA
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 12.0.0 to before 12.0.36 Fixed in 12.0.36 Patch available GHSA-f4v5-65jj-pcr2
- org.eclipse.jetty:jetty-server (Maven) Vendor— Affected 12.1.0 to before 12.1.10 Fixed in 12.1.10 Patch available GHSA-f4v5-65jj-pcr2
CPE configurations NVD · 1
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* | 12.0.0 to before 12.0.36; 12.1.0 to before 12.1.10 | Vulnerable | Eclipse Foundation |
- cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* Versions 12.0.0 to before 12.0.36; 12.1.0 to before 12.1.10 Vulnerable ·Eclipse Foundation
Remediation
- Fix · GHSA-f4v5-65jj-pcr2 org.eclipse.jetty:jetty-server (Maven) Fixed in 12.0.36 Advisory →
- Fix · GHSA-f4v5-65jj-pcr2 org.eclipse.jetty:jetty-server (Maven) Fixed in 12.1.10 Advisory →
Red Hat 22 advisories
- RHSA-2026:88159 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.17 security update.
- OpenShift Developer Tools and Services 4.17 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88158 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.19 security update.
- OpenShift Developer Tools and Services 4.19 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88157 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.20 security update.
- OpenShift Developer Tools and Services 4.20 registry.redhat.io/ocp-tools-4/jenkins-rhel9
Show 19 more Red Hat advisories
- RHSA-2026:88156 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.16 security update.
- OpenShift Developer Tools and Services 4.16 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88155 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.21 security update.
- OpenShift Developer Tools and Services 4.21 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88154 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.22 security update.
- OpenShift Developer Tools and Services 4.22 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88153 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.18 security update.
- OpenShift Developer Tools and Services 4.18 registry.redhat.io/ocp-tools-4/jenkins-rhel9
- RHSA-2026:88151 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.14 security update.
- OpenShift Developer Tools and Services 4.14 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88152 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.12 security update.
- OpenShift Developer Tools and Services 4.12 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88149 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.13 security update.
- OpenShift Developer Tools and Services 4.13 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:88150 Released 2026-10-22 · Red Hat rating CriticalRelease of Red Hat OpenShift Developer Tools - Openshift Jenkins 4.15 security update.
- OpenShift Developer Tools and Services 4.15 registry.redhat.io/ocp-tools-4/jenkins-rhel8
- RHSA-2026:84734 Released 2026-10-19 · Red Hat rating CriticalRHOAI 3.4.5 - Red Hat OpenShift AI
- Red Hat OpenShift AI 3.4 registry.redhat.io/rhoai/odh-ai-gateway-payload-processing-rhel9, registry.redhat.io/rhoai/odh-automl-rhel9, registry.redhat.io/rhoai/odh-autorag-rhel9 +47
- RHSA-2026:83612 Released 2026-10-15 · Red Hat rating ImportantRed Hat build of Debezium 3.6.3 release
- Red Hat Build of Debezium 3.6
- RHSA-2026:71675 Released 2026-09-24 · Red Hat rating ImportantRed Hat Build of Apache Camel 4.18.4 for Spring Boot release.
- Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16
- RHSA-2026:66545 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.13.6 release and security update
- Red Hat AMQ Broker 7.13.6
- RHSA-2026:66488 Released 2026-09-10 · Red Hat rating ImportantRed Hat AMQ Broker 7.14.1 release and security update
- Red Hat AMQ Broker 7.14.1
- RHSA-2026:63327 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.16.13 Async Update
- Red Hat Satellite 6.16 for RHEL 8 openvox-server-8.15.2-1.el8sat, python-aiohttp-3.14.3-1.el8pc, python3.11-aiohttp-3.14.3-1.el8pc +1
- Red Hat Satellite 6.16 for RHEL 9 openvox-server-8.15.2-1.el9sat, python-aiohttp-3.14.3-1.el9pc, python3.11-aiohttp-3.14.3-1.el9pc +1
- RHSA-2026:63385 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.19.4 Async Update
- Red Hat Satellite 6.19 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
- RHSA-2026:63387 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.17.11 Async Update
- Red Hat Satellite 6.17 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +3
- RHSA-2026:63386 Released 2026-09-03 · Red Hat rating ImportantSatellite 6.18.9 Async Update
- Red Hat Satellite 6.18 for RHEL 9 ansible-core-1:2.16.19-1.el9sat, ansible-test-1:2.16.19-1.el9sat, openvox-server-8.15.2-1.el9sat +4
- RHSA-2026:62260 Released 2026-09-01 · Red Hat rating ImportantRed Hat OpenShift Dev Spaces 3.30.0 Release.
- Red Hat OpenShift Dev Spaces 3.30 registry.redhat.io/devspaces/code-rhel9, registry.redhat.io/devspaces/configbump-rhel9, registry.redhat.io/devspaces/dashboard-rhel9 +7
- RHSA-2026:54435 Released 2026-08-12 · Red Hat rating ImportantStreams for Apache Kafka 3.2.1 release and security update
- Streams for Apache Kafka 3.2.1
Vendor assessments
Red Hat
Red Hat rating: Moderate. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| OpenShift Developer Tools and Services | Affected | No fix yet |
| Red Hat Enterprise Linux 9 | Affected | No fix yet |
| Red Hat Satellite 6 | Affected | No fix yet |
| Red Hat Single Sign-On 7 | Affected | No fix planned: Will not fix |
| Red Hat build of Apache Camel - HawtIO 4 | Affected | No fix yet |
| OpenShift Developer Tools and Services 4.12 | Fixed | RHSA-2026:88152 |
| OpenShift Developer Tools and Services 4.13 | Fixed | RHSA-2026:88149 |
| OpenShift Developer Tools and Services 4.14 | Fixed | RHSA-2026:88151 |
| OpenShift Developer Tools and Services 4.15 | Fixed | RHSA-2026:88150 |
| OpenShift Developer Tools and Services 4.16 | Fixed | RHSA-2026:88156 |
| OpenShift Developer Tools and Services 4.17 | Fixed | RHSA-2026:88159 |
| OpenShift Developer Tools and Services 4.18 | Fixed | RHSA-2026:88153 |
| OpenShift Developer Tools and Services 4.19 | Fixed | RHSA-2026:88158 |
| OpenShift Developer Tools and Services 4.20 | Fixed | RHSA-2026:88157 |
| OpenShift Developer Tools and Services 4.21 | Fixed | RHSA-2026:88155 |
| OpenShift Developer Tools and Services 4.22 | Fixed | RHSA-2026:88154 |
| Red Hat AMQ Broker 7.13.6 | Fixed | RHSA-2026:66545 |
| Red Hat AMQ Broker 7.14.1 | Fixed | RHSA-2026:66488 |
| Red Hat Build of Debezium 3.6 | Fixed | RHSA-2026:83612 |
| Red Hat OpenShift AI 3.4 | Fixed | RHSA-2026:84734 |
| Red Hat OpenShift Dev Spaces 3.30 | Fixed | RHSA-2026:62260 |
| Red Hat Satellite 6.16 for RHEL 8 | Fixed | RHSA-2026:63327 |
| Red Hat Satellite 6.16 for RHEL 9 | Fixed | RHSA-2026:63327 |
| Red Hat Satellite 6.17 for RHEL 9 | Fixed | RHSA-2026:63387 |
| Red Hat Satellite 6.18 for RHEL 9 | Fixed | RHSA-2026:63386 |
| Red Hat Satellite 6.19 for RHEL 9 | Fixed | RHSA-2026:63385 |
| Red Hat build of Apache Camel 4.18.4 for Spring Boot 3.5.16 | Fixed | RHSA-2026:71675 |
| Streams for Apache Kafka 3.2.1 | Fixed | RHSA-2026:54435 |
Not affected: 28 products
- OpenShift Developer Tools and Services 4.12
- OpenShift Developer Tools and Services 4.13
- OpenShift Developer Tools and Services 4.14
- OpenShift Developer Tools and Services 4.15
- OpenShift Developer Tools and Services 4.16
- OpenShift Developer Tools and Services 4.17
- OpenShift Developer Tools and Services 4.18
- OpenShift Developer Tools and Services 4.19
- OpenShift Developer Tools and Services 4.20
- OpenShift Developer Tools and Services 4.21
- OpenShift Developer Tools and Services 4.22
- Red Hat Data Grid 8
- Red Hat Enterprise Linux 7
- Red Hat Enterprise Linux 8
- Red Hat Enterprise Linux 9
- Red Hat JBoss Enterprise Application Platform Expansion Pack
- Red Hat Offline Knowledge Portal
- Red Hat OpenShift AI (RHOAI)
- Red Hat OpenShift AI 3.4
- Red Hat OpenShift Dev Spaces 3.30
- Red Hat Satellite 6
- Red Hat Satellite 6.16 for RHEL 8
- Red Hat Satellite 6.16 for RHEL 9
- Red Hat Satellite 6.17 for RHEL 9
- Red Hat Satellite 6.18 for RHEL 9
- Red Hat Satellite 6.19 for RHEL 9
- Red Hat build of Apicurio Registry 3
- streams for Apache Kafka 2
Timeline
- 2026-10-02 Threatist record created from CVE-2026-10051
- 2026-10-03 Alias added: GHSA-f4v5-65jj-pcr2
- 2026-10-06 Affected versions changed · Red Hat
- 2026-10-16 Fix available: RHSA-2026:83612 · Red Hat
- 2026-10-16 Fix available: Red Hat Build of Debezium 3.6 · Red Hat
- 2026-10-20 Fix available: RHSA-2026:84734 · Red Hat
- 2026-10-20 Fix available: Red Hat OpenShift AI 3.4 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88149 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88152 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88150 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88156 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88153 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88154 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88157 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88155 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88151 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88158 · Red Hat
- 2026-10-23 Fix available: RHSA-2026:88159 · Red Hat
- 2026-10-23 Fix available: OpenShift Developer Tools and Services 4.12, OpenShift Developer Tools and Services 4.13, OpenShift Developer Tools and Services 4.14 +8 · Red Hat
- 2026-11-03 Affected versions changed · Red Hat
References
Other 8
- https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2
- https://github.com/jetty/jetty.project/pull/15162
- https://github.com/jetty/jetty.project/pull/15163
- https://github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8eb
- https://github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9
- https://github.com/jetty/jetty.project
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10
More Eclipse Foundation Jetty vulnerabilities
- TI-2023-23979 The HTTP/2 protocol allows a denial of service (server resource consumption) because… KEVCVSS 3.1HIGH 7.5
- TI-2026-08807 Digest authentication lossy encoding CVSS 4.0HIGH 8.7
- TI-2026-01972 HTTP Request Smuggling via Chunked Extension Quoted-String Parsing CVSS 3.1CRITICAL 9.1
- TI-2015-01867 The exception handling code in Eclipse Jetty before 9.2.9.v20150224 allows remote… CVSS 3.0HIGH 7.5
- TI-2021-09394 Uncontrolled resource consumption in Eclipse Jetty CVSS 3.1HIGH 7.5
- TI-2021-13463 Information disclosure in Eclipse Jetty CVSS 3.1MEDIUM 5.3
Sources
- CVE-2026-10051 · CVE Program
- CVE-2026-10051 · NVD
- FIRST EPSS
- GHSA-f4v5-65jj-pcr2 · GitHub Advisory Database · CC BY 4.0
- CVE-2026-10051 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences