CVE-2026-1605: CWE-400 Uncontrolled Resource Consumption in Eclipse Foundation Eclipse Jetty
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.
AI Analysis
Technical Summary
Eclipse Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 contain a vulnerability in the GzipHandler where the JDK Inflater allocated to decompress gzip-encoded HTTP requests is not released if the corresponding response is not compressed. This occurs because the release mechanism is tied to the compressed response, which does not trigger when the response is uncompressed, leading to a resource leak. This uncontrolled resource consumption can cause denial of service conditions. The vulnerability has a CVSS 3.1 score of 7.5 (high) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by exhausting server resources due to unreleased JDK Inflater instances when processing specially crafted compressed HTTP requests that receive uncompressed responses. This can degrade or disrupt service availability on affected Eclipse Jetty servers.
Mitigation Recommendations
Red Hat has released security updates addressing this vulnerability in their JBoss Enterprise Application Platform 8.1 packages that include Eclipse Jetty. Applying these official patches will remediate the issue. Users should apply the relevant Red Hat errata updates (e.g., RHSA-2026:25125) to fix the vulnerability. Patch status is confirmed by the vendor advisory. No alternative mitigations are specified.
CVE-2026-1605: CWE-400 Uncontrolled Resource Consumption in Eclipse Foundation Eclipse Jetty
Description
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.
CVSS v3.1
Score 7.5high
Affected software
pkg:maven/org.eclipse.jetty/jetty-serverRun on your own infrastructure? Check whether these packages are installed with threat-finder — our free open-source scanner.
AI-Powered Analysis
Machine-generated threat intelligence
Technical Analysis
Eclipse Jetty versions 12.0.0-12.0.31 and 12.1.0-12.1.5 contain a vulnerability in the GzipHandler where the JDK Inflater allocated to decompress gzip-encoded HTTP requests is not released if the corresponding response is not compressed. This occurs because the release mechanism is tied to the compressed response, which does not trigger when the response is uncompressed, leading to a resource leak. This uncontrolled resource consumption can cause denial of service conditions. The vulnerability has a CVSS 3.1 score of 7.5 (high) with network attack vector, low attack complexity, no privileges or user interaction required, and impacts availability only.
Potential Impact
The vulnerability allows an attacker to cause a denial of service by exhausting server resources due to unreleased JDK Inflater instances when processing specially crafted compressed HTTP requests that receive uncompressed responses. This can degrade or disrupt service availability on affected Eclipse Jetty servers.
Mitigation Recommendations
Red Hat has released security updates addressing this vulnerability in their JBoss Enterprise Application Platform 8.1 packages that include Eclipse Jetty. Applying these official patches will remediate the issue. Users should apply the relevant Red Hat errata updates (e.g., RHSA-2026:25125) to fix the vulnerability. Patch status is confirmed by the vendor advisory. No alternative mitigations are specified.
Technical Details
- Data Version
- 5.2
- Assigner Short Name
- eclipse
- Date Reserved
- 2026-01-29T10:58:31.963Z
- Cvss Version
- 3.1
- State
- PUBLISHED
- Vendor Advisory Urls
- [{"url":"https://access.redhat.com/security/cve/CVE-2026-1605","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:25125","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:25089","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:8509","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:25126","vendor":"Red Hat"},{"url":"https://access.redhat.com/errata/RHSA-2026:21772","vendor":"Red Hat"}]
Threat ID: 69a9562d0e5bba37ca990db6
Added to database: 03/05/2026, 10:08:45 UTC
Last enriched: 07/15/2026, 08:29:40 UTC
Last updated: 07/31/2026, 19:22:57 UTC
Views: 444
Community Reviews
0 reviewsCrowdsource mitigation strategies, share intel context, and vote on the most helpful responses. Sign in to add your voice and help keep defenders ahead.
Want to contribute mitigation steps or threat intel context? Sign in or create an account to join the community discussion.
Actions
Updates to AI analysis require Pro Console access. Upgrade inside Console → Billing.
Need more coverage?
Upgrade to Pro Console for AI refresh and higher limits.
For incident response and remediation, OffSeq services can help resolve threats faster.
Latest Threats
Check if your credentials are on the dark web
Instant breach scanning across billions of leaked records. Free tier available.