# CVE-2026-1605: Eclipse Jetty memory leak in GzipHandler

Source: https://junglewise.ai/threats/cve-2026-1605-eclipse-jetty-memory-leak-in-gziphandler  
Publisher: Junglewise Threat Intelligence, https://junglewise.ai/threats  
Published: 2026-03-05. Updated: 2026-06-30  
License: CC BY 4.0 with a link back

CVE-2026-1605 · Severity: high · CVSS 7.5 · Published 2026-03-05

Eclipse Jetty, a widely used web server and servlet container, contains a memory leak vulnerability in its GzipHandler component. When the server processes a compressed request but sends back an uncompressed response, it fails to release internal memory resources. An attacker can exploit this by sending many such requests, eventually causing the server to run out of memory and crash, leading to a denial of service.

Technologies: [Eclipse Foundation Jetty](https://junglewise.ai/threats/technologies/jetty), [org.eclipse.jetty:jetty-server (Maven)](https://junglewise.ai/threats/technologies/org-eclipse-jetty-jetty-server). Vendors: [Eclipse Foundation](https://junglewise.ai/threats/vendors/eclipse-foundation), [Maven](https://junglewise.ai/threats/vendors/maven).

## Quick answers

**Is CVE-2026-1605 exploited in the wild?** No. Junglewise Threat Intelligence has no report of CVE-2026-1605 being exploited in the wild.

**How severe is CVE-2026-1605?** High severity, with a CVSS score of 7.5, published 5 March 2026.

**Which products and versions are affected?** Eclipse Foundation Jetty 12.0.0-12.0.31, 12.1.0-12.1.5; org.eclipse.jetty:jetty-server (Maven) ECOSYSTEM:introduced=12.1.0,fixed=12.1.6.

**Is there a fix for CVE-2026-1605?** Yes. org.eclipse.jetty:jetty-server (Maven): upgrade to 12.1.6 or later. Junglewise finds every place you run it, drafts the upgrade and applies it once you approve.

**How is CVE-2026-1605 attacked?** It is attacked over the network, in a software library.

**Am I affected by CVE-2026-1605?** Check whether you run Eclipse Foundation Jetty or org.eclipse.jetty:jetty-server (Maven) at an affected version. Junglewise does that check for you around the clock: connect your code, cloud and domains, and it matches new vulnerabilities like this one against what you actually run and tells you when one reaches you.

## How to fix

- org.eclipse.jetty:jetty-server (Maven): upgrade to 12.1.6 or later

  ```sh
  # set org.eclipse.jetty:jetty-server to 12.1.6 in your pom.xml or build.gradle
  ```


## Technical details

A memory leak exists in the Eclipse Jetty GzipHandler due to improper resource management of the JDK Inflater. When a request is received with 'Content-Encoding: gzip', a GzipRequest object is created and an Inflater is allocated from the pool. However, the release mechanism (gzipRequest.destroy()) is tied to the GzipResponseAndCallback wrapper, which is only instantiated if the response is also compressed. If the response is not compressed (e.g., missing 'Accept-Encoding: gzip'), the Inflater is never returned to the pool. Remote, unauthenticated attackers can exploit this by sending repeated compressed requests to trigger an OutOfMemoryError (OOME) and crash the JVM. The issue is patched in versions 12.0.32 and 12.1.6.

## Affected products

- Eclipse Foundation Jetty 12.0.0-12.0.31, 12.1.0-12.1.5

## Identifiers

- CVE-2026-1605
- GHSA-xxh7-fcf3-rj7f

## Timeline

- 2026-03-05: advisory: Initial disclosure by Eclipse Foundation
- 2026-03-05: disclosed
- 2026-05-28: patched: Red Hat released updates for OpenShift Dev Spaces

## References

- [https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f](https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f)
- [https://access.redhat.com/errata/RHSA-2026:21772](https://access.redhat.com/errata/RHSA-2026:21772)
- [https://access.redhat.com/errata/RHSA-2026:25089](https://access.redhat.com/errata/RHSA-2026:25089)
- [https://access.redhat.com/errata/RHSA-2026:25125](https://access.redhat.com/errata/RHSA-2026:25125)
- [https://access.redhat.com/errata/RHSA-2026:25126](https://access.redhat.com/errata/RHSA-2026:25126)
- [https://access.redhat.com/errata/RHSA-2026:8509](https://access.redhat.com/errata/RHSA-2026:8509)
- [https://access.redhat.com/security/cve/CVE-2026-1605](https://access.redhat.com/security/cve/CVE-2026-1605)

## Related threats

- [Eclipse Jetty path normalization bypass via URI path parameters](https://junglewise.ai/threats/cve-2026-8384-eclipse-jetty-path-normalization-bypass-via-uri-path-parameters)
- [Eclipse Jetty host authority and Host header mismatch](https://junglewise.ai/threats/cve-2026-6790-eclipse-jetty-host-authority-and-host-header-mismatch)
- [Eclipse Jetty information leakage via retained HTTP/1.1 trailers](https://junglewise.ai/threats/cve-2026-10051-eclipse-jetty-information-leakage-via-retained-http-1-1-trailers)
- [Eclipse Jetty buffer leak in HttpConnection](https://junglewise.ai/threats/cve-2024-7708-eclipse-jetty-buffer-leak-in-httpconnection)
- [Eclipse Jetty HTTP request smuggling in chunk extension parsing](https://junglewise.ai/threats/cve-2026-2332-eclipse-jetty-http-request-smuggling-in-chunk-extension-parsing)