Junglewise Threat Intelligence

CVE-2026-10051: Eclipse Jetty information leakage via retained HTTP/1.1 trailers

CVE-2026-10051 · Severity: medium · CVSS 4 · Published 2026-07-14

Technologies: Eclipse Foundation Jetty. Vendors: Eclipse Foundation, Eclipse.

Executive brief

Eclipse Jetty, a widely used web server and servlet engine, contains a flaw where HTTP request 'trailers' (metadata sent at the end of a request) are not properly cleared between requests on the same connection. This means that sensitive information or data checksums from one user's request could be incorrectly attached to a subsequent request from a different user or session. This could lead to incorrect application behavior, data leakage, or the bypassing of certain data integrity checks.

Technical details

A vulnerability exists in Jetty's HttpConnection class where the _trailers field, a connection-scoped HttpFields.Mutable object, is not reset between requests. When an HTTP/1.1 request with trailers is processed, the parsedTrailer() method populates this field, and the messageComplete() method subsequently stamps these trailers onto the next request (N+1) on the same keep-alive connection. This results in 'stale' trailers being reported for requests that have none, or a union of trailers if the subsequent request also contains them. Attackers can exploit this to cause Time-of-Check Time-of-Use (TOCTOU) issues or information disclosure if application logic relies on request.getTrailers() for security-sensitive decisions. The issue is fixed in versions 12.0.36 and 12.1.10.

Affected products

  • Eclipse Jetty >= 12.0.0, <= 12.0.35
  • Eclipse Jetty >= 12.1.0, <= 12.1.9

Timeline

  • 2026-07-13: disclosed
  • 2026-07-14: advisory: NVD published CVE-2026-10051
  • 2026-07-22: patched: GitHub Advisory reviewed and updated

References

Related threats