Skip to content
Log inStart free trial

GHSA-xxh7-fcf3-rj7f CVE-2026-1605

The Eclipse Jetty Server Artifact has a Gzip request memory leak

High Maven
Severity
7.5 / 10
High · CVSS 3.1
Exploit chance (EPSS)
0.74%
Chance of exploitation in the next 30 days. Higher than 54.66% of scored vulnerabilities.
Known exploited
No
Not in CISA's catalog
Weakness
CWE-400 Uncontrolled Resource Consumption
CWE-401 Missing Release of Memory after Effective Lifetime
Fix
12.1.6
Upgrade org.eclipse.jetty:jetty-server to this version or later

Description

Description (as reported)

There is a memory leak when using GzipHandler in jetty-12.0.30 that can cause off-heap OOMs. This can be used for DoS attacks so I'm reporting this as a vulnerability.

The leak is created by requests where the request is inflated (Content-Encoding: gzip) and the response is not deflated (no Accept-Encoding: gzip). In these conditions, a new inflator will be created by GzipRequest and never released back into GzipRequest.__inflaterPool because gzipRequest.destory() is not called.

In heap dumps one can see thousands of java.util.zip.Inflator objects, which use both Java heaps and native memory. Leaking native memory causes of off-heap OOMs.

Code path in GzipHandler.handle():

  1. Line 601: GzipRequest is created when request inflation is needed.
  2. Lines 611-616: The callback is only wrapped in GzipResponseAndCallback when both inflation and deflation are needed.
  3. Lines 619-625: If the handler accepts the request (returns true), gzipRequest.destroy() is only called in the "request not accepted" path (returns false)

When deflation is needed, GzipResponseAndCallback (lines 102 and 116) properly calls gzipRequest.destroy() in its succeeded() and failed() methods. But this wrapper is only created when deflation is needed.

Possible fix: The callback should be wrapped whenever a GzipRequest is created, not just when deflation is needed. This ensures gzipRequest.destroy() is always called when the request completes.

Impact

The leak causes the JVM to crash with OOME.

Patches

No patches yet.

Workarounds

Disable GzipHandler.

References

https://github.com/jetty/jetty.project/issues/14260

https://gitlab.eclipse.org/security/cve-assignment/-/issues/79

Affected versions

Maven

PackageVulnerableFixed in
org.eclipse.jetty:jetty-server
>= 12.1.0, < 12.1.6
12.1.6
org.eclipse.jetty:jetty-server
>= 12.0.0, < 12.0.32
12.0.32

How to fix

Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.

org.eclipse.jetty:jetty-server Maven → 12.1.6

maven
<dependency><groupId>org.eclipse.jetty</groupId><artifactId>jetty-server</artifactId><version>12.1.6</version></dependency>
gradle
implementation("org.eclipse.jetty:jetty-server:12.1.6")

Severity breakdown

CVSS 3.1 7.5

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H

Attack vector
Network
Attack complexity
Low
Privileges required
None
User interaction
None
Scope
Unchanged
Confidentiality
None
Integrity
None
Availability
High

Weakness

CWE-400: Uncontrolled Resource Consumption

The product does not properly control the allocation and maintenance of a limited resource.

How to prevent it
  • Architecture and Design: Design throttling mechanisms into the system architecture. The best protection is to limit the amount of resources that an unauthorized user can cause to be expended. A strong authentication and access control model will help prevent such attacks from occurring in the first place. The login application should be protected against DoS attacks as much as possible. Limiting the database access, perhaps by caching result sets, can help minimize the resources expended. To further limit the potential for a DoS attack, consider tracking the rate of requests received from users and blocking requests that exceed a defined rate threshold.
  • Architecture and Design: Mitigation of resource exhaustion attacks requires that the target system either: recognizes the attack and denies that user further access for a given amount of time, or uniformly throttles all requests in order to make it more difficult to consume resources more quickly than they can again be freed. The first of these solutions is an issue in itself though, since it may allow attackers to prevent the use of the system by a particular valid user. If the attacker impersonates the valid user, they may be able to prevent the user from accessing the server in question. The second solution is simply difficult to effectively institute -- and even when properly done, it does not provide a full solution. It simply makes the attack require more resources on the part of the attacker.
  • Architecture and Design: Ensure that protocols have specific limits of scale placed on them.
  • Implementation: Ensure that all failures in resource allocation place the system into a safe posture.

CWE-401: Missing Release of Memory after Effective Lifetime

The product does not sufficiently track and release allocated memory after it has been used, making the memory unavailable for reallocation and reuse.

How to prevent it
  • Implementation: Choose a language or tool that provides automatic memory management, or makes manual memory management less error-prone. For example, glibc in Linux provides protection against free of invalid pointers. When using Xcode to target OS X or iOS, enable automatic reference counting (ARC) [REF-391]. To help correctly and consistently manage memory when programming in C++, consider using a smart pointer class such as std::auto_ptr (defined by ISO/IEC ISO/IEC 14882:2003), std::shared_ptr and std::unique_ptr (specified by an upcoming revision of the C++ standard, informally referred to as C++ 1x), or equivalent solutions such as Boost.
  • Architecture and Design: Use an abstraction library to abstract away risky APIs. Not a complete solution.
  • Architecture and Design, Build and Compilation: Consider using the Boehm-Demers-Weiser garbage collector (bdwgc), which can help avoid leaks.

References

Advisories

Packages

Other links

Timeline

  1. Published
  2. Last updated by the source
  3. Latest EPSS score
AdvisorySeverityWhy it's related
GHSA-7p3p-8qv8-m2vh
Eclipse Jetty: HTTP Authority/Host mismatch
Medium Also affects org.eclipse.jetty:jetty-server
GHSA-f4v5-65jj-pcr2
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
High Also affects org.eclipse.jetty:jetty-server
GHSA-9299-c6m4-mjhc
Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests
High Also affects org.eclipse.jetty:jetty-server
GHSA-q4rv-gq96-w7c5
**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request
High Also affects org.eclipse.jetty:jetty-server
GHSA-g8m5-722r-8whq
Eclipse Jetty's ThreadLimitHandler.getRemote() vulnerable to remote DoS attacks
Medium Also affects org.eclipse.jetty:jetty-server
GHSA-p26g-97m4-6q7c
Eclipse Jetty's cookie parsing of quoted values can exfiltrate values from other cookies
Medium Also affects org.eclipse.jetty:jetty-server
GHSA-qw69-rqj8-6qw8
OutOfMemoryError for large multipart without filename in Eclipse Jetty
Medium Also affects org.eclipse.jetty:jetty-server
GHSA-8mpp-f3f7-xc28
Jetty SslConnection does not release pooled ByteBuffers in case of errors
High Also affects org.eclipse.jetty:jetty-server
Is this in your code?

MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.

Check your repos with MergeHarbor