Is CVE-2026-1605 exploited in the wild?

No. Junglewise Threat Intelligence has no report of CVE-2026-1605 being exploited in the wild.

How severe is CVE-2026-1605?

High severity, with a CVSS score of 7.5, published 5 March 2026.

Which products and versions are affected?

Eclipse Foundation Jetty 12.0.0-12.0.31, 12.1.0-12.1.5; org.eclipse.jetty:jetty-server (Maven) ECOSYSTEM:introduced=12.1.0,fixed=12.1.6.

Is there a fix for CVE-2026-1605?

Yes. org.eclipse.jetty:jetty-server (Maven): upgrade to 12.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

How is CVE-2026-1605 attacked?

It is attacked over the network, in a software library.

Am I affected by CVE-2026-1605?

Check whether you run Eclipse Foundation Jetty or org.eclipse.jetty:jetty-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

CVE-2026-1605: Eclipse Jetty memory leak in GzipHandler

CVE-2026-1605 · Severity: high · CVSS 7.5 · Published 2026-03-05

Eclipse Jetty, a widely used web server and servlet container, contains a memory leak vulnerability in its GzipHandler component. When the server processes a compressed request but sends back an uncompressed response, it fails to release internal memory resources. An attacker can exploit this by sending many such requests, eventually causing the server to run out of memory and crash, leading to a denial of service.

Technologies: Eclipse Foundation Jetty, org.eclipse.jetty:jetty-server (Maven). Vendors: Eclipse Foundation, Maven.

Quick answers

Is CVE-2026-1605 exploited in the wild?: No. Junglewise Threat Intelligence has no report of CVE-2026-1605 being exploited in the wild.
How severe is CVE-2026-1605?: High severity, with a CVSS score of 7.5, published 5 March 2026.
Which products and versions are affected?: Eclipse Foundation Jetty 12.0.0-12.0.31, 12.1.0-12.1.5; org.eclipse.jetty:jetty-server (Maven) ECOSYSTEM:introduced=12.1.0,fixed=12.1.6.
Is there a fix for CVE-2026-1605?: Yes. org.eclipse.jetty:jetty-server (Maven): upgrade to 12.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.
How is CVE-2026-1605 attacked?: It is attacked over the network, in a software library.
Am I affected by CVE-2026-1605?: Check whether you run Eclipse Foundation Jetty or org.eclipse.jetty:jetty-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

How to fix

org.eclipse.jetty:jetty-server (Maven): upgrade to 12.1.6 or later

# set org.eclipse.jetty:jetty-server to 12.1.6 in your pom.xml or build.gradle

Technical details

A memory leak exists in the Eclipse Jetty GzipHandler due to improper resource management of the JDK Inflater. When a request is received with 'Content-Encoding: gzip', a GzipRequest object is created and an Inflater is allocated from the pool. However, the release mechanism (gzipRequest.destroy()) is tied to the GzipResponseAndCallback wrapper, which is only instantiated if the response is also compressed. If the response is not compressed (e.g., missing 'Accept-Encoding: gzip'), the Inflater is never returned to the pool. Remote, unauthenticated attackers can exploit this by sending repeated compressed requests to trigger an OutOfMemoryError (OOME) and crash the JVM. The issue is patched in versions 12.0.32 and 12.1.6.

Affected products

Eclipse Foundation Jetty 12.0.0-12.0.31, 12.1.0-12.1.5

Identifiers

CVE-2026-1605
GHSA-xxh7-fcf3-rj7f

Timeline

2026-03-05: advisory: Initial disclosure by Eclipse Foundation
2026-03-05: disclosed
2026-05-28: patched: Red Hat released updates for OpenShift Dev Spaces

References

This page as Markdown. Free to reuse under CC BY 4.0 with a link back.