CVE-2026-10051: Eclipse Jetty Server Cross-Request Leakage Vulnerability
Summary
CVE-2026-10051: Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections. Affects org.eclipse.jetty:jetty-server across 2 version ranges.
>= 12.0.0, < 12.0.36
>= 12.1.0, < 12.1.10
Fixed in 12.0.36 or 12.1.10, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a widely-used open-source Java-based web server and servlet container that provides a robust environment for running web applications. It is known for its scalability, performance, and support for modern web protocols. However, it has a vulnerability that affects its HTTP/1.1 keep-alive connections, specifically related to the handling of trailers in HTTP requests.
Vulnerability Detail
The vulnerability arises from the HttpConnection._trailers field, which is connection-scoped and is not reset between requests. When a request with trailers (e.g., X-Checksum) is processed, the trailers are stored and can inadvertently be returned in subsequent requests on the same connection. This leads to potential data leakage where stale trailer information from one request can be accessed in another, resulting in incorrect application behavior. The risk is heightened in scenarios where time-of-check to time-of-use (TOCTOU) vulnerabilities may occur, allowing malicious actors to exploit this leakage.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.0.3612.0.36 -
>= 12.1.0, < 12.1.1012.1.10
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary measure, avoid relying on HTTP request trailers for security-sensitive logic. Additionally, consider disabling persistent connections by closing the connection after each HTTP/1.1 request to mitigate the risk of cross-request leakage.
Conclusion
The Eclipse Jetty Server vulnerability CVE-2026-10051 poses a risk of cross-request leakage of HTTP trailers, which can lead to data exposure. It is crucial to update to the patched versions or implement workarounds to mitigate the risk.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The vulnerability allows for cross-request leakage of HTTP trailers on keep-alive connections, potentially exposing sensitive data from previous requests.
Affected versions include all versions prior to 12.0.36 and 12.1.10.
You can use Vulert's playground at Vulert Scanner to check if your application is affected by this vulnerability without needing to sign up.
HTTP trailers are additional fields that can be sent after the body of a message in HTTP/1.1, often used for metadata like checksums.
The CVSS score for this vulnerability is 6.9, indicating a moderate severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
