Description
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.
This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.
In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | 12.0.0 – ≤ 12.0.31, 12.1.0. – ≤ 12.1.5 | — |
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | jetty12 | 12.0.32-1 | — |
| Debian 13 | jetty12 | No fix yet | — |
Ubuntu
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 26.10 | jetty9 +1 | No fix yet | — |
| Ubuntu 26.04 LTS | jetty9 +1 | No fix yet | — |
| Ubuntu 25.10 | jetty9 | No fix yet | — |
| Ubuntu 24.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 22.04 LTS | jetty9 | No fix yet | — |
Show 3 more (older releases, extended support, other products)Fewer releases
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Ubuntu 20.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 18.04 LTS | jetty9 | No fix yet | — |
| Ubuntu 16.04 LTS | jetty9 | No fix yet | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat JBoss EAP 8 | eap8-activemq-artemis +14 | 2.40.0-7.redhat_00015.1.el8eap | RHSA-2026:25125 |
| Red Hat JBoss EAP 8 | eap8-eap-product-conf-parent +1 | 801.6.1-1.GA_redhat_00001.1.el8eap | RHSA-2026:25125 |
| Red Hat JBoss EAP 8 | eap8-undertow | 2.3.24-3.SP2_redhat_00001.1.el8eap | RHSA-2026:25125 |
| Red Hat JBoss EAP 8 | eap8-wildfly +3 | 8.1.6-7.GA_redhat_00010.1.el8eap | RHSA-2026:25125 |
Wolfi
| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Wolfi rolling | akhq | 0.27.0-r1 | — |
| Wolfi rolling | apache-pulsar-4.2 | 4.2.1-r0 | — |
| Wolfi rolling | confluent-kafka | 8.3.0.373-r0 | — |
| Wolfi rolling | dependency-track +1 | 4.14.0-r0 | — |
| Wolfi rolling | druid | 36.0.0-r4 | — |
| Wolfi rolling | kafka-4.1 | 4.1.2-r1 | — |
| Wolfi rolling | kafka-4.2 | 4.2.0-r5 | — |
| Wolfi rolling | neo4j-2025.10 +1 | No fix yet | — |
| Wolfi rolling | strimzi-kafka-operator-kafka-init +5 | 0.50.1-r4 | — |
| Wolfi rolling | trino | 479-r7 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| Maven | org.eclipse.jetty:jetty-server | >= 12.1.0, < 12.1.6 | 12.1.6 | GHSA-xxh7-fcf3-rj7f |
| Maven | org.eclipse.jetty:jetty-server | >= 12.0.0, < 12.0.32 | 12.0.32 | GHSA-xxh7-fcf3-rj7f |
Advisories 5
- RHSA-2026:25125 Red Hat Security Advisory: Red Hat JBoss Enterprise Application Platform 8.1.6 security update Red Hat Security Advisories (RHSA) · Oct 15, 2026
- WID-SEC-2026-2444 Oracle Fusion Middleware: Mehrere Schwachstellen BSI CERT-Bund (WID) · Oct 7, 2026
- WID-SEC-2026-2451 Oracle Siebel CRM: Mehrere Schwachstellen BSI CERT-Bund (WID) · Sep 2, 2026
- WID-SEC-2026-0604 Eclipse Jetty: Schwachstelle ermöglicht Denial of Service BSI CERT-Bund (WID) · Aug 26, 2026
- WID-SEC-2026-0862 RealObjects PDFreactor: Mehrere Schwachstellen BSI CERT-Bund (WID) · Mar 25, 2026