CVE-2026-12611 Details
Description
A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.
A denial-of-service vulnerability has been identified in Eclipse Jetty's HTTP/2 implementation, specifically in the 'http2-common' and 'jetty-http2-common' packages, affecting versions 9.4.36 through 9.4.63, 10.0.0 through 10.0.31, and 11.0.0 through 11.0.31. The issue arises from a race condition when the server processes 'RST_STREAM' and 'GOAWAY' frames from the client. This concurrency can reset the HTTP2Flusher.terminated state, allowing write entries to be enqueued that are never processed, ultimately blocking all threads and causing the server to become unresponsive.
Users can upgrade to Jetty versions 11.0.32, 10.0.32, or 9.4.64. Instructions for downloading these versions are available on the Jetty GitHub repository.
Metrics
CVSS 4.0 Severity and Vector Strings:
VolerionCVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
Volerion
Assessed Sep 8, 2026CISA-ADP
Assessed Sep 8, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
| URL | Source(s) | Tag(s) |
|---|---|---|
| https://github.com/jetty/jetty.project/security/advisories/GHSA-gpg9-4257-cfm3 | [email protected] | AdvisoryRemedyVendor |
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
Affected Products
| Product | Versions |
|---|---|
| Eclipse Jetty | >= 11.0.0, <= 11.0.31 (semver) >= 10.0.0, <= 10.0.31 (semver) >= 9.4.36, <= 9.4.63 (semver) |
CPE
Remediation
| |
Change History
2 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Sep 9, 2026 | CVE Modified | CISA-ADP |
| Sep 8, 2026 | New CVE Received | [email protected] |