CVE-2026-10051: Eclipse Jetty information leakage via retained HTTP/1.1 trailers

CVE-2026-10051 · Severity: medium · CVSS 4 · Published 2026-07-14

Eclipse Jetty, a widely used web server and servlet engine, contains a flaw where HTTP request 'trailers' (metadata sent at the end of a request) are not properly cleared between requests on the same connection. This means that sensitive information or data checksums from one user's request could be incorrectly attached to a subsequent request from a different user or session. This could lead to incorrect application behavior, data leakage, or the bypassing of certain data integrity checks.

Technologies: Eclipse Foundation Jetty, org.eclipse.jetty:jetty-server (Maven). Vendors: Eclipse Foundation, Maven.

Quick answers

Is CVE-2026-10051 exploited in the wild?
No. Junglewise Threat Intelligence has no report of CVE-2026-10051 being exploited in the wild.
How severe is CVE-2026-10051?
Medium severity, with a CVSS score of 4, published 14 July 2026.
Which products and versions are affected?
Eclipse Foundation Jetty >= 12.0.0, <= 12.0.35, 12.0.0 to 12.0.35, 12.1.0 to 12.1.9; org.eclipse.jetty:jetty-server (Maven) ECOSYSTEM:introduced=12.0.0,fixed=12.0.36.
Is there a fix for CVE-2026-10051?
Yes. org.eclipse.jetty:jetty-server (Maven): upgrade to 12.0.36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-10051 attacked?
It is attacked over the network, in a software library.
Am I affected by CVE-2026-10051?
Check whether you run Eclipse Foundation Jetty or org.eclipse.jetty:jetty-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

  • org.eclipse.jetty:jetty-server (Maven): upgrade to 12.0.36 or later
    # set org.eclipse.jetty:jetty-server to 12.0.36 in your pom.xml or build.gradle

Technical details

A vulnerability exists in Jetty's HttpConnection class where the _trailers field, a connection-scoped HttpFields.Mutable object, is not reset between requests. When an HTTP/1.1 request with trailers is processed, the parsedTrailer() method populates this field, and the messageComplete() method subsequently stamps these trailers onto the next request (N+1) on the same keep-alive connection. This results in 'stale' trailers being reported for requests that have none, or a union of trailers if the subsequent request also contains them. Attackers can exploit this to cause Time-of-Check Time-of-Use (TOCTOU) issues or information disclosure if application logic relies on request.getTrailers() for security-sensitive decisions. The issue is fixed in versions 12.0.36 and 12.1.10.

Affected products

  • Eclipse Jetty >= 12.0.0, <= 12.0.35
  • Eclipse Jetty >= 12.1.0, <= 12.1.9

Identifiers

  • CVE-2026-10051
  • GHSA-f4v5-65jj-pcr2

Timeline

  • 2026-07-13: disclosed
  • 2026-07-14: advisory: NVD published CVE-2026-10051
  • 2026-07-22: patched: GitHub Advisory reviewed and updated

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.