The vulnerability in Eclipse Jetty's GzipHandler arises when a compressed HTTP request with Content-Encoding: gzip is processed but the server response is not compressed. The JDK Inflater used for decompressing the request is allocated but not released because the release mechanism depends on the response being compressed. This leads to a resource leak of the Inflater, causing uncontrolled resource consumption (memory and CPU), which can be exploited remotely to cause a denial of service. The issue is tracked as CWE-400 (Uncontrolled Resource Consumption), CWE-401 (Missing Release of Memory), and CWE-772 (Missing Release of Resource after Effective Lifetime). Red Hat has published advisories and released patches for affected versions, including updates to Red Hat JBoss Enterprise Application Platform 8.1 that incorporate the fix.

An attacker can remotely trigger a denial of service by sending specially crafted compressed HTTP requests that cause the server to leak JDK Inflater resources. This resource exhaustion can degrade server performance or cause it to become unavailable to legitimate users. There is no impact on confidentiality or integrity, but availability is severely affected. No known exploits are reported in the wild at this time.

A security update fixing this vulnerability is available and should be applied. Red Hat has released patches for affected products, including Red Hat JBoss Enterprise Application Platform 8.1. Users should upgrade to the fixed versions as per the vendor advisory. No alternative mitigations are specified. Patch status is confirmed by Red Hat advisories.