Executive brief
Eclipse Jetty, a widely used web server and servlet engine, contains a flaw where HTTP request 'trailers' (metadata sent at the end of a request) are not properly cleared between requests on the same connection. This means that sensitive information or data checksums from one user's request could be incorrectly attached to a subsequent request from a different user or session. This could lead to incorrect application behavior, data leakage, or the bypassing of certain data integrity checks.
Technical details
A vulnerability exists in Jetty's HttpConnection class where the _trailers field, a connection-scoped HttpFields.Mutable object, is not reset between requests. When an HTTP/1.1 request with trailers is processed, the parsedTrailer() method populates this field, and the messageComplete() method subsequently stamps these trailers onto the next request (N+1) on the same keep-alive connection. This results in 'stale' trailers being reported for requests that have none, or a union of trailers if the subsequent request also contains them. Attackers can exploit this to cause Time-of-Check Time-of-Use (TOCTOU) issues or information disclosure if application logic relies on request.getTrailers() for security-sensitive decisions. The issue is fixed in versions 12.0.36 and 12.1.10.
Affected products
- Eclipse Jetty >= 12.0.0, <= 12.0.35
- Eclipse Jetty >= 12.1.0, <= 12.1.9
Timeline
- 2026-07-13: disclosed
- 2026-07-14: advisory: NVD published CVE-2026-10051
- 2026-07-22: patched: GitHub Advisory reviewed and updated
References
- https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2
- https://github.com/jetty/jetty.project/pull/15162
- https://github.com/jetty/jetty.project/pull/15163
- https://github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8eb
- https://github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9