This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response.
In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.
Default status is the baseline for the product, each version can override it (e.g. patched versions marked unaffected).
| Vendor | Product | Default status | Versions | |||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|
| Eclipse Foundation | Eclipse Jetty | unaffected |
|
No data.
No data.
No data.
Project Subscriptions
No data.
No advisories yet.
Solution
No solution given by the vendor.
Workaround
No workaround given by the vendor.
Thu, 05 Mar 2026 15:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Metrics |
ssvc
|
Thu, 05 Mar 2026 10:15:00 +0000
| Type | Values Removed | Values Added |
|---|---|---|
| Description | In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak. | |
| Weaknesses | CWE-400 CWE-401 |
|
| References |
| |
| Metrics |
cvssV3_1
|
Projects
Sign in to view the affected projects.
MITRE
Status: PUBLISHED
Assigner: eclipse
Published:
Updated: 2026-03-05T14:46:16.289Z
Reserved: 2026-01-29T10:58:31.963Z
Link: CVE-2026-1605
Vulnrichment
Updated: 2026-03-05T14:46:13.125Z
NVD
Status : Received
Published: 2026-03-05T10:15:56.890
Modified: 2026-03-05T10:15:56.890
Link: CVE-2026-1605
Redhat
No data.
OpenCVE Enrichment
No data.