Riskcovery

CVE-2026-1605

State
Published
Severity
7.5 High
Published
Mar 5, 2026
Updated
Sep 14, 2026
Reserved
Jan 29, 2026

Read the record on cve.org

Description

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.

This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.

Scores

CVSSScoreVectorSource
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Heclipse
3.17.5 HighCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hredhat-SADP

Weaknesses

  • CWE-400 Uncontrolled Resource Consumption
  • CWE-401 Missing Release of Memory after Effective Lifetime
  • CWE-772 Missing Release of Resource after Effective Lifetime

Affected Products

ProductVersions
Eclipse JettyEclipse Foundation
  • 12.0.0 through 12.0.31Affected
  • 12.1.0. through 12.1.5Affected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.