# CVE-2026-10051: Eclipse Jetty information leakage via retained HTTP/1.1 trailers

Source: https://junglewise.ai/threats/cve-2026-10051-eclipse-jetty-information-leakage-via-retained-http-1-1-trailers  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-07-14. Updated: 2026-07-22  
License: CC BY 4.0 with a link back

CVE-2026-10051 · Severity: medium · CVSS 4 · Published 2026-07-14

Eclipse Jetty, a widely used web server and servlet engine, contains a flaw where HTTP request 'trailers' (metadata sent at the end of a request) are not properly cleared between requests on the same connection. This means that sensitive information or data checksums from one user's request could be incorrectly attached to a subsequent request from a different user or session. This could lead to incorrect application behavior, data leakage, or the bypassing of certain data integrity checks.

Technologies: [Eclipse Foundation Jetty](https://junglewise.ai/threats/technologies/jetty), [org.eclipse.jetty:jetty-server (Maven)](https://junglewise.ai/threats/technologies/org-eclipse-jetty-jetty-server). Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-10051 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-10051 being exploited in the wild.

**How severe is CVE-2026-10051?** Medium severity, with a CVSS score of 4, published 14 July 2026.

**Which products and versions are affected?** Eclipse Foundation Jetty >= 12.0.0, <= 12.0.35, 12.0.0 to 12.0.35, 12.1.0 to 12.1.9; org.eclipse.jetty:jetty-server (Maven) ECOSYSTEM:introduced=12.0.0,fixed=12.0.36.

**Is there a fix for CVE-2026-10051?** Yes. org.eclipse.jetty:jetty-server (Maven): upgrade to 12.0.36 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-10051 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-10051?** Check whether you run Eclipse Foundation Jetty or org.eclipse.jetty:jetty-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.eclipse.jetty:jetty-server (Maven): upgrade to 12.0.36 or later

  ```sh
  # set org.eclipse.jetty:jetty-server to 12.0.36 in your pom.xml or build.gradle
  ```


## Technical details

A vulnerability exists in Jetty's HttpConnection class where the _trailers field, a connection-scoped HttpFields.Mutable object, is not reset between requests. When an HTTP/1.1 request with trailers is processed, the parsedTrailer() method populates this field, and the messageComplete() method subsequently stamps these trailers onto the next request (N+1) on the same keep-alive connection. This results in 'stale' trailers being reported for requests that have none, or a union of trailers if the subsequent request also contains them. Attackers can exploit this to cause Time-of-Check Time-of-Use (TOCTOU) issues or information disclosure if application logic relies on request.getTrailers() for security-sensitive decisions. The issue is fixed in versions 12.0.36 and 12.1.10.

## Affected products

- Eclipse Jetty >= 12.0.0, <= 12.0.35
- Eclipse Jetty >= 12.1.0, <= 12.1.9

## Identifiers

- CVE-2026-10051
- GHSA-f4v5-65jj-pcr2

## Timeline

- 2026-07-13: disclosed
- 2026-07-14: advisory: NVD published CVE-2026-10051
- 2026-07-22: patched: GitHub Advisory reviewed and updated

## References

- [https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2](https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2)
- [https://github.com/jetty/jetty.project/pull/15162](https://github.com/jetty/jetty.project/pull/15162)
- [https://github.com/jetty/jetty.project/pull/15163](https://github.com/jetty/jetty.project/pull/15163)
- [https://github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8eb](https://github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8eb)
- [https://github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9](https://github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9)

## Related threats

- [Eclipse Jetty path normalization bypass via URI path parameters](https://junglewise.ai/threats/cve-2026-8384-eclipse-jetty-path-normalization-bypass-via-uri-path-parameters)
- [Eclipse Jetty host authority and Host header mismatch](https://junglewise.ai/threats/cve-2026-6790-eclipse-jetty-host-authority-and-host-header-mismatch)
- [Eclipse Jetty buffer leak in HttpConnection](https://junglewise.ai/threats/cve-2024-7708-eclipse-jetty-buffer-leak-in-httpconnection)
- [Eclipse Jetty HTTP request smuggling in chunk extension parsing](https://junglewise.ai/threats/cve-2026-2332-eclipse-jetty-http-request-smuggling-in-chunk-extension-parsing)
- [Eclipse Jetty privilege escalation in JASPIAuthenticator](https://junglewise.ai/threats/eclipse-jetty-privilege-escalation-in-jaspiauthenticator-0b1324cb)