Threats affecting pkg:maven/org.eclipse.jetty/jetty-server

CVE-2026-18660 is a high-severity vulnerability in Eclipse Jetty's jetty-server and jetty-proxy components where the host whitelist/blacklist filtering is case-sensitive. This allows hosts that differ only by case to bypass the intended restrictions.

CVE-2026-12611 is a high-severity vulnerability in Eclipse Jetty where a race condition in HTTP/2 frame handling can cause server threads to become indefinitely blocked, leading to server unresponsiveness. The issue arises when the server processes RST_STREAM and GOAWAY frames, causing the HTTP2Flusher.terminated flag to be reset improperly. This allows entries to be enqueued that are never processed, blocking threads waiting on writes.

A client may issue specially crafted HTTP/1.1 chunked requests to a Jetty server that cause Jetty and an intermediary proxy to interpret different request boundaries, potentially resulting in HTTP request smuggling. This is caused by Jetty accepting a lone LF character as a terminator in parts of chunked request parsing. Depending on the Jetty version and configured HTTP compliance mode, this may occur in chunk extensions, chunk data termination, or trailer termination.

In Eclipse Jetty, the HTTP/1.1 parser is vulnerable to request smuggling when chunk extensions are used, similar to the "funky chunks" techniques outlined here: * https://w4ke.info/2025/06/18/funky-chunks.html * https://w4ke.info/2025/10/29/funky-chunks-2.html Jetty terminates chunk extension parsing at \r\n inside quoted strings instead of treating this as an error. POST / HTTP/1.1 Host: localhost Transfer-Encoding: chunked 1;ext="val X 0 GET /smuggled HTTP/1.1 ... Note how the chunk extension does not close the double quotes, and it is able to inject a smuggled request.

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.

The Jetty URI parser has some key differences to other common parsers when evaluating invalid or unusual URIs. Differential parsing of URIs in systems using multiple components may result in security by-pass. For example a component that enforces a black list may interpret the URIs differently from one that generates a response. At the very least, differential parsing may divulge implementation details.

A vulnerability in Eclipse Jetty's ThreadLimitHandler.getRemote() allows remote attackers to cause a denial-of-service (DoS) condition by triggering out-of-memory errors through crafted requests. This affects multiple Jetty versions across supported and end-of-life branches. Fixed versions have been released to address this issue. Users are advised to avoid using ThreadLimitHandler and consider QoSHandler as a workaround.