Eclipse Jetty Security Advisory - CVE-2026-1605
Severity: High (CVSS 3.1)
Affected component: org.eclipse.jetty:jetty-server
Affected versions:
- 12.0.0 through 12.0.31
- 12.1.0 through 12.1.5
Fix available:
- 12.0.32 (available on Maven Central)
- 12.1.6 (available on Maven Central)
Description:
There is a memory leak when using GzipHandler that can cause off-heap OutOfMemoryErrors. The leak is triggered by requests where the request body is inflated (Content-Encoding: gzip) but the response is not deflated (no Accept-Encoding: gzip header). In these conditions, a new Inflater is created by GzipRequest and never released back into the inflater pool because gzipRequest.destroy() is not called.
This causes thousands of java.util.zip.Inflater objects to accumulate, consuming both Java heap and native memory. Leaking native memory causes off-heap OOMs and JVM crashes. This can be exploited for denial of service attacks.
Weakness: CWE-400 (Uncontrolled Resource Consumption), CWE-401 (Missing Release of Memory after Effective Lifetime)
Workaround: Disable GzipHandler.
Credit:
https://github.com/glebashnik,
https://github.com/bjorncsFor full technical details, consult the GitHub security advisory:
https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f
The Eclipse Jetty Team
