CVE-2026-1605Disclosure(eclipse / jetty)

LOWCVSS 7.5 · HIGH

Signal is active with 1 mentions in latest observed window

Immediate actions

Track advisory updates for patch or workaround availability

Recommended action window: Monitor and triage in normal cycle

NVD description

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.

eclipse CVEs Back to dashboard

0.0/ 10 priority

Sources & remediation

Vendor / third-party advisories

https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f

Other references

Weakness type (CWE)

CWE-400CWE-401CWE-772

Priority

LOW

Exploitation

NONE

PoC

NONE

Patch

NONE

Momentum

STABLE

Are you affected?

If you run products in this scope, you should treat this CVE as relevant to your environment.

jetty

Threat summary

4 mentions across 3 observed days
Momentum state: stable

What's happening

Technical details provided in 4 signals
Disclosure: 2 classified signals
General: 1 classified signal
Peaked 2d ago at 2 mentions (2026-03-05); latest day: 1
4 total mentions across 3 days

Affected systems

Vendors

eclipse

Products

jetty

Deep dive

Activity timeline4 mentions / 3d

Signal classification3 categories

Disclosure

250.0%

Discl

125.0%

General

125.0%

Referenced assets4 URLs

By indicator

Classification over time

Date	Total	Labels

2026-03-05	2	Discl1General1
2026-03-06	1	Disclosure1
2026-03-09	1	Disclosure1

Full discourse4 posts

Heroes Cyber Security@hcs_ctf213d
Disclosure
We just published our recent vulnerability research on a memory leak affecting the Jetty web server, one of the popular Java web servers, on our website. Shout out to the researchers involved in this research: - miraicantsleep - daffainfo Vuln Analysis: https://hcs-team.com/blog/cve-2026-1605/ https://t.co/r0EbdUvFXt
Post summary
The post announces the release of research on a memory leak in Jetty, but does not provide a PoC, exploit code, or patch information.
00060254
53 followersView on X
DailyCVE@dailycve216d
Disclosure
🟠 Eclipse Jetty, Resource Leak, #CVE-2026-1605 (Medium) https://dailycve.com/eclipse-jetty-resource-leak-cve-2026-1605-medium/
Post summary
The message announces a medium‑severity resource leak in Eclipse Jetty (CVE-2026-1605) but offers no PoC, exploit details, or patch information.
00000483
164 followersView on X
CVE@CVEnew217d
General
CVE-2026-1605 In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is p… https://www.cve.org/CVERecord?id=CVE-2026-1605
Post summary
The tweet references CVE‑2026‑1605 in Eclipse Jetty’s GzipHandler, noting the vulnerability’s context, but it provides no proof‑of‑concepts, exploits, patches, or evidence of active exploitation.
0000076
56.6K followersView on X
CyberDudeBivash® | Global Cybersecurity Company@cyberbivash217d
Discl
🚨 CYBERDUDEBIVASH SENTINEL APEX ALERT 🚨 Threat: CVE-2026-1605 - Eclipse Jetty JDK Inflater Memory Leak Intel Report: https://ift.tt/PkGwnfs
Post summary
This tweet reports a newly disclosed memory leak vulnerability (CVE-2026-1605) in Jetty JDK, referenced through an intel report, but provides no evidence of exploitation, PoC, or mitigation details.
0000042
343 followersView on X

CPE platform detail1 entries

Part:

Vendor:

Product:

Version:

Target SW:

Target HW:

1 of 1 entries

Part	Vendor	Product	Version	Target SW	Target HW
App	eclipse	jetty	-	-	-

Explore more

Back to dashboard eclipse CVEs jetty vulnerabilities

What researchers are saying

CVE-2026-1605

Heroes Cyber Security@hcs_ctfDisclosure

The post announces the release of research on a memory leak in Jetty, but does not provide a PoC, exploit code, or patch information.

DailyCVE@dailycveDisclosure

The message announces a medium‑severity resource leak in Eclipse Jetty (CVE-2026-1605) but offers no PoC, exploit details, or patch information.

CVE@CVEnewGeneral

The tweet references CVE‑2026‑1605 in Eclipse Jetty’s GzipHandler, noting the vulnerability’s context, but it provides no proof‑of‑concepts, exploits, patches, or evidence of active exploitation.

CyberDudeBivash® | Global Cybersecurity Company@cyberbivashDiscl

This tweet reports a newly disclosed memory leak vulnerability (CVE-2026-1605) in Jetty JDK, referenced through an intel report, but provides no evidence of exploitation, PoC, or mitigation details.