CVE-2026-1605: Eclipse Jetty Server Gzip Request Memory Leak Vulnerability
Summary
CVE-2026-1605: The Eclipse Jetty Server Artifact has a Gzip request memory leak. Affects org.eclipse.jetty:jetty-server across 2 version ranges.
>= 12.0.0, < 12.0.32
>= 12.1.0, < 12.1.6
Fixed in 12.0.32 or 12.1.6, depending on the release line you run. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
Eclipse Jetty is a widely used open-source Java-based web server and servlet container. It is known for its scalability, performance, and support for asynchronous processing. Jetty is often employed in embedded systems and cloud environments due to its lightweight nature. However, a recent vulnerability has been identified in the GzipHandler component of Jetty, which can lead to significant memory leaks under certain conditions.
Vulnerability Detail
The vulnerability arises from a memory leak in the GzipHandler when processing requests with Gzip compression. Specifically, when a request is received with 'Content-Encoding: gzip' but the response does not include 'Accept-Encoding: gzip', a new Inflator object is created and never released. This results in an accumulation of java.util.zip.Inflator objects, consuming both Java heap and native memory, ultimately leading to out-of-memory errors (OOMEs) in the JVM. The leak can be exploited to perform denial-of-service (DoS) attacks, causing the server to crash.
How To Fix
Latest published version: 12.1.14 as of 23 Oct 2026
Upgrading to it may include breaking changes; the versions below are the minimum fixed release for this vulnerability.
If you can't move to the latest
The minimum fixed version depends on the release line you run.
-
>= 12.0.0, < 12.0.3212.0.32 -
>= 12.1.0, < 12.1.612.1.6
Tip — Not sure which release line you're on? Vulert can find the fix for the version you are using. Scan free →
Workaround
As a temporary workaround, you can disable the GzipHandler in your Jetty configuration to prevent the memory leak until a patch is applied. This can be done by modifying your server configuration to exclude the GzipHandler from the request processing pipeline.
Conclusion
The Eclipse Jetty Server vulnerability CVE-2026-1605 poses a significant risk due to a memory leak in the GzipHandler. It is crucial for users to update to the latest patched versions or implement workarounds to mitigate potential impacts on their applications.
See every vulnerability recorded for org.eclipse.jetty:jetty-server →
FAQ
The vulnerability can lead to memory leaks that cause the JVM to crash due to out-of-memory errors, potentially resulting in service downtime.
You can use Vulert, which monitors and alerts for open-source vulnerabilities in your software. Simply upload your pom.xml file to Vulert's playground at Vulert Scanner to check for vulnerabilities.
Yes, patches are available. Upgrade to Jetty version 12.0.32 or 12.1.6 or later to mitigate the vulnerability.
If you cannot update immediately, consider disabling the GzipHandler as a temporary workaround to prevent the memory leak.
The CVSS score for this vulnerability is 7.5, indicating a high severity level.
References
Related vulnerabilities
Recent vulnerabilities recorded for org.eclipse.jetty:jetty-server.
