CVE-2026-1605 The Eclipse Jetty Server Artifact has a Gzip request memory leak
Attackers can cause resource exhaustion and denial of service by sending compressed requests that trigger a memory leak in the GzipHandler.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2026-1605?
CVE-2026-1605 is a high-severity denial of service vulnerability in Eclipse Jetty, published on 5 Mar 2026. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed.
This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.
Which versions are affected by CVE-2026-1605?
4 open source packages ship an affected version, including org.eclipse.jetty:jetty-server. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
org.eclipse.jetty:jetty-server Maven | From 12.0.0 | 12.0.32 |
org.eclipse.jetty:jetty-server Maven | From 12.0.0 | 12.0.32 |
org.eclipse.jetty:jetty-server Maven | From 12.1.0 | 12.1.6 |
org.eclipse.jetty:jetty-server Maven | From 12.1.0 | 12.1.6 |
Products include Eclipse Jetty.
How do I fix CVE-2026-1605?
Upgrade org.eclipse.jetty:jetty-server to a fixed version for your release line: 12.0.32 or 12.1.6.
Upgrade, then put limits on request size, rate and nesting depth so one client cannot exhaust the service. More about Denial of service.
Is CVE-2026-1605 being exploited?
There is no known exploitation of CVE-2026-1605 in the wild and no public exploit code.
Other vulnerabilities in Eclipse Jetty
- CVE-2016-4800 Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request
- CVE-2019-17638 Operation on a Resource after Expiration or Release in Jetty Server
- CVE-2018-12538 Access and integrity issue within Eclipse Jetty
- CVE-2026-10050 Digest authentication lossy encoding
- CVE-2025-5115 MadeYouReset HTTP/2 vulnerability
Sources
Also known as CLEANSTART-2026-DU44734, CLEANSTART-2026-GS83780, CLEANSTART-2026-KO17168, CLEANSTART-2026-MN49716, CLEANSTART-2026-UT17320, DEBIAN-CVE-2026-1605 and 36 more.