CVE-2026-1605 Details
Description
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.
A memory leak vulnerability has been identified in Eclipse Jetty versions 12.0.0 through 12.0.31 and 12.1.0 through 12.1.5. The issue arises in the GzipHandler class when a compressed HTTP request with 'Content-Encoding: gzip' is received, but the response is not compressed. This scenario causes the JDK Inflater, used for decompressing the request, to be allocated but not released. The release mechanism is linked to the response compression, so when the response is uncompressed, the inflater remains active, leading to a memory leak.
As a workaround, GzipHandler can be disabled. Users should also upgrade to Jetty versions 12.1.6 or 12.0.32, where this vulnerability has been patched.
Metrics
CVSS 4.0 Severity and Vector Strings:
No CVSS 4.0 data is available for this CVE.
CVSS 3.x Severity and Vector Strings:
No data available for CVSS Version 2.0 on this CVE.
CISA-ADP
Assessed Mar 5, 2026References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving this site. These are references gathered from the official CVE record and are not endorsed by Volerion.
Weakness Enumeration
| CWE-ID | CWE Name | Source |
|---|---|---|
| CWE-400 | Uncontrolled Resource Consumption | [email protected] |
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-401 | Missing Release of Memory after Effective Lifetime | [email protected] |
| CWE-772 | Missing Release of Resource after Effective Lifetime | redhat-SADP |
Affected Products
| Product | Versions |
|---|---|
| eclipse jetty | >= 12.0.0, < 12.0.32 >= 12.1.0, < 12.1.6 |
CPE
Remediation
| |
Change History
10 change records found show changes
| Date | Action | Recorded By |
|---|---|---|
| Aug 27, 2026 | CVE Modified | redhat-SADP |
| Aug 26, 2026 | CVE Modified | redhat-SADP |
| Aug 26, 2026 | CVE Modified | [email protected] |
| Aug 4, 2026 | CVE Modified | redhat-SADP |
| Jul 15, 2026 | CVE Modified | redhat-SADP |
| Jun 30, 2026 | CVE Modified | redhat-SADP |
| Jun 17, 2026 | CVE Modified | CISA-ADP |
| Jun 17, 2026 | CVE Modified | [email protected] |
| Mar 6, 2026 | Initial Analysis | [email protected] |
| Mar 5, 2026 | New CVE Received | [email protected] |