CVE-2026-1605

eclipse jetty

TLP:CLEAR

csirt@kutim:~/threat-intel/cve/CVE-2026-1605

Katalog CVE

CVSS 7.5 · High EPSS 0,68%

Kerentanan Uncontrolled Resource Consumption pada eclipse jetty. Skor CVSS 3.1 7.5 (High) menurut eclipse.org.

Deskripsi (NVD)

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.

Rincian

Terbit di NVD
5 Maret 2026
Terakhir diubah
27 Agustus 2026
Status NVD
Modified
CVSS 3.1
7.5 (High), sumber eclipse.org
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H · uraikan di kalkulator
Jenis kelemahan (CWE)
CWE-400: Uncontrolled Resource Consumption
CWE-401: Missing Release of Memory after Effective Lifetime
CWE-772: Missing Release of Resource after Effective Lifetime
EPSS (30 hari)
0,68% peluang dieksploitasi; lebih tinggi dari 51,0% CVE lain

Produk dan versi terdampak

VendorProdukVersi terdampak
eclipse jetty Versi 12.0.0 hingga sebelum 12.0.32
eclipse jetty Versi 12.1.0 hingga sebelum 12.1.6

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

Sumber: NVD · CVE.org · EPSS. Halaman ini disusun otomatis dari data tersebut; pembaruan terakhir 5 Okt 2026, 20:11 WITA. Kalau sistem di Perangkat Daerah memakai produk ini dan butuh bantuan, laporkan lewat kanal pelaporan.