Skip to main content

Eclipse Jetty CVE-2026-10051

| EUVDEUVD-2026-43645 MEDIUM
Information Exposure (CWE-200)
2026-07-14 eclipse GHSA-f4v5-65jj-pcr2
Information Disclosure Red Hat Suse Eclipse Jetty Eclipse Foundation
6.9
CVSS 4.0 · Vendor: eclipse
Share

Severity by source

Vendor (eclipse) PRIMARY
6.9 MEDIUM
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vuln.today AI
5.3 MEDIUM

Network-reachable with no privileges or interaction required; limited to low confidentiality impact as only trailer data is exposed with no integrity or availability consequence.

3.1 AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
4.0 AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N
SUSE
5.3 MEDIUM
AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
Red Hat
5.3 MEDIUM
qualitative

Primary rating from Vendor (eclipse).

CVSS VectorVendor: eclipse

Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
None
Scope
X

Lifecycle Timeline

2
Analysis Generated
Jul 14, 2026 - 09:33 vuln.today
CVE Published
Jul 14, 2026 - 08:44 cve.org
MEDIUM 6.9

Blast Radius

ecosystem impact
† from your stack dependencies † transitive graph · vuln.today resolves 4-path depth
  • 105 maven packages depend on org.eclipse.jetty:jetty-server (36 direct, 69 indirect)

Ecosystem-wide dependent count for version 12.0.0.

DescriptionCVE.org

In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.

AnalysisAI

HTTP/1.1 trailer leakage in Eclipse Jetty allows a remote unauthenticated attacker to read trailer headers from a previous request when sharing a persistent connection with another party. Trailers sent in an initial request are incorrectly retained in the server's connection state, causing them to bleed into all subsequent requests on the same keep-alive connection - either appended wholesale (if the later request has no trailers) or merged with the later request's own trailers. No public exploit has been identified at time of analysis, and the vulnerability is not listed in CISA KEV.

Technical ContextAI

HTTP/1.1 chunked transfer encoding permits 'trailers' - additional header fields appended after the message body. These are defined in RFC 7230 and are commonly used to transmit checksums, digital signatures, or authentication tokens computed over the body. The affected component is Eclipse Jetty's HTTP/1.1 connection handler (CPE: cpe:2.3:a:eclipse_foundation:eclipse_jetty:*:*:*:*:*:*:*:*), which manages persistent (keep-alive) connections. The root cause is CWE-200 (Exposure of Sensitive Information to an Unauthorized Actor): Jetty fails to clear the trailer state between requests on the same connection, causing cross-request data exposure. This is most severe in proxy or gateway deployments where multiple clients' requests are multiplexed over shared backend connections, enabling cross-user trailer leakage.

RemediationAI

Upgrade Eclipse Jetty to a patched release once one is confirmed by the Eclipse Foundation - the upstream fix reference at https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119 should be monitored for a specific target version, as no exact patch version is confirmed in available data at time of analysis. As a compensating control, applications should avoid placing sensitive or security-relevant values (authentication tokens, HMAC signatures, session identifiers) in HTTP/1.1 trailers until a patch is applied; this eliminates the meaningful confidentiality exposure even if the bug persists. Operators running Jetty behind a reverse proxy (e.g., nginx, HAProxy) should evaluate whether connection pooling to Jetty backends is enabled; disabling persistent backend connections (keep-alive off toward Jetty) eliminates the cross-request leakage path at the cost of increased connection overhead. HTTP/2 and HTTP/3 multiplexing semantics differ and are not described as affected by this CVE.

More in Eclipse Jetty

View all
CVE-2026-2332 CRITICAL
9.1 Apr 14

HTTP request smuggling in Eclipse Jetty's HTTP/1.1 parser lets remote unauthenticated attackers desynchronize front-end/
CVE-2026-19204 HIGH
8.7 Sep 07

Unauthenticated remote denial-of-service in Eclipse Jetty's WebSocket implementation allows any network-accessible clien
CVE-2026-12611 HIGH
8.7 Sep 08

HTTP/2 thread-exhaustion denial-of-service in Eclipse Jetty allows unauthenticated remote clients to permanently block a
CVE-2026-19203 HIGH
8.3 Sep 08

HTTP/1.1 request smuggling in Eclipse Jetty allows unauthenticated remote attackers to desynchronize request boundary pa
CVE-2026-5795 HIGH
7.4 Apr 08

Privilege escalation in Eclipse Jetty 9.4.0-12.1.7 allows unauthenticated remote attackers to bypass authentication via

CVE-2026-6790 MEDIUM
5.3 Jul 14

Eclipse Jetty fails to enforce RFC 9110/9112's requirement that the HTTP request authority (host and port) match the val
CVE-2026-8384 MEDIUM
5.3 Jul 14

Eclipse Jetty mishandles HTTP URI path parameters containing semicolons combined with traversal sequences, delivering an

Same weakness CWE-200 – Information Exposure

View all
CVE-2024-24919 HIGH POC
8.6
CVE-2016-6415 HIGH POC
7.5
CVE-2013-7331 MEDIUM POC
6.5
CVE-2025-31125 MEDIUM POC
5.3
CVE-2025-11749 CRITICAL POC
9.8
CVE-2017-16894 HIGH POC
7.5
CVE-2017-11165 CRITICAL POC
9.8
CVE-2020-3259 HIGH
7.5

Same technique Information Disclosure

View all
CVE-2019-2725 CRITICAL POC
9.8
CVE-2021-34523 CRITICAL POC
9.0
CVE-2013-2251 CRITICAL POC
9.8
CVE-2017-5638 CRITICAL POC
9.8
CVE-2025-24813 CRITICAL POC
9.8
CVE-2015-1701 HIGH POC
7.8
CVE-2017-0147 HIGH POC
7.5
CVE-2014-6324 HIGH POC
8.8

Vendor StatusVendor

SUSE

Severity: Moderate
Product Status
SUSE Linux Enterprise Desktop 15 SP7 Affected
SUSE Linux Enterprise High Performance Computing 15 SP7 Affected
SUSE Linux Enterprise Module for Development Tools 15 SP7 Affected
SUSE Linux Enterprise Module for Package Hub 15 SP7 Affected
SUSE Linux Enterprise Server 15 SP7 Affected

Share

CVE-2026-10051 vulnerability details – vuln.today
Back

This site uses cookies essential for authentication and security. No tracking or analytics cookies are used. Privacy Policy