Eclipse Jetty versions 10.0.7, 11.0.7, and all versions from 10.0.7 up to but not including 10.0.23, and from 11.0.7 up to but not including 11.0.23, contain a buffer leak vulnerability (CWE-400, CWE-401). This occurs when processing requests that have a body but reading the body results in zero bytes read, such as with HTTP 100-Continue or slow network conditions. The leak can cause resource exhaustion impacting availability. The CVSS 3.1 score is 7.5 (high), reflecting network attack vector, low attack complexity, no privileges or user interaction required, unchanged scope, no confidentiality or integrity impact, but high availability impact. No official patch or remediation level has been published yet, and no known exploits are reported in the wild.

The vulnerability can cause a buffer leak leading to resource exhaustion on the affected server, potentially resulting in denial of service (availability impact). There is no impact on confidentiality or integrity. The issue arises from improper handling of request bodies that read zero bytes, especially under HTTP 100-Continue or slow network conditions.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, monitor for updates from the Eclipse Foundation. No vendor-provided mitigation or temporary fix is currently documented.