Wysoka

The Eclipse Jetty Server Artifact has a Gzip request memory leak

Ujawniono: 05.03.2026
Aktualizacja: 11.10.2026 13:20

Description (as reported)

There is a memory leak when using GzipHandler in jetty-12.0.30 that can cause off-heap OOMs. This can be used for DoS attacks so I'm reporting this as a vulnerability.

The leak is created by requests where the request is inflated (Content-Encoding: gzip) and the response is not deflated (no Accept-Encoding: gzip). In these conditions, a new inflator will be created by GzipRequest and never released back into GzipRequest.__inflaterPool because gzipRequest.destory() is not called.

In heap dumps one can see thousands of java.util.zip.Inflator objects, which use both Java heaps and native memory. Leaking native memory causes of off-heap OOMs.

Code path in GzipHandler.handle():

Line 601: GzipRequest is created when request inflation is needed.
Lines 611-616: The callback is only wrapped in GzipResponseAndCallback when both inflation and deflation are needed.
Lines 619-625: If the handler accepts the request (returns true), gzipRequest.destroy() is only called in the "request not accepted" path (returns false)

When deflation is needed, GzipResponseAndCallback (lines 102 and 116) properly calls gzipRequest.destroy() in its succeeded() and failed() methods. But this wrapper is only created when deflation is needed.

Possible fix: The callback should be wrapped whenever a GzipRequest is created, not just when deflation is needed. This ensures gzipRequest.destroy() is always called when the request completes.

Impact

The leak causes the JVM to crash with OOME.

Patches

No patches yet.

Workarounds

Disable GzipHandler.

References

https://github.com/jetty/jetty.project/issues/14260

https://gitlab.eclipse.org/security/cve-assignment/-/issues/79

Czego dotyczy

Kliknij technologię, aby zobaczyć wszystkie dotyczące jej podatności.

Platforma	Paczka	Podatne wersje	Poprawka w wersji
Java / Kotlin (Maven)	org.eclipse.jetty:jetty-server	>= 12.1.0, < 12.1.6, >= 12.0.0, < 12.0.32	12.1.6, 12.0.32

Odnośniki

Ocena CVSS 7.5/10

Wektor CVSS: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Słabość (CWE): CWE-400, CWE-401
Platforma: Java / Kotlin (Maven)
Paczka: org.eclipse.jetty:jetty-server
Ujawniono: 05.03.2026
Aktualizacja: 11.10.2026 13:20

Źródła i licencje

OSV / GitHub Advisory Database - GHSA-xxh7-fcf3-rj7f - CC BY 4.0

Historia podatności: org.eclipse.jetty:jetty-server

Wszystkie opisane podatności tej paczki (Java / Kotlin (Maven)), od najnowszej. Widać, czy to jednorazowa wpadka, czy paczka, której trzeba pilnować.

Wszystkie (29) w archiwum

Wszystkich wpisów: 29
Pierwsza → ostatnia: 10.2018 07.2026
Bez poprawki: 0
Wykorzystywana w atakach: 0

Rozkład istotności

Krytyczna 4
Wysoka 10
Średnia 13
Niska 2

Ujawnienia w latach

2018: 8
2019: 5
2020: 2
2021: 3
2022: 3
2023: 2
2024: 1
2025: 1
2026: 4

22.07.2026

Eclipse Jetty: DoS attack triggering OutOfMemory with 100-Continue requests

Wysoka · 7.5 CVE-2024-7708 >= 10.0.7, < 10.0.23, >= 11.0.7, < 11.0.23 10.0.23, 11.0.23
05.03.2026

The Eclipse Jetty Server Artifact has a Gzip request memory leak ten wpis

Wysoka · 7.5 CVE-2026-1605 >= 12.1.0, < 12.1.6, >= 12.0.0, < 12.0.32 12.1.6, 12.0.32
08.05.2025

**UNSUPPORTED WHEN ASSIGNED** GzipHandler causes part of request body to be seen as request body of a separate request

Wysoka · 7.2 CVE-2024-13009 >= 9.4.0, < 9.4.57.v20241219 9.4.57.v20241219
07.07.2022

Jetty SslConnection does not release pooled ByteBuffers in case of errors

Wysoka · 7.5 CVE-2022-2191 >= 10.0.0, < 10.0.10, >= 11.0.0, < 11.0.10 10.0.10, 11.0.10
06.04.2021

Jetty vulnerable to incorrect handling of invalid large TLS frame, exhausting CPU resources

Wysoka · 7.5 CVE-2021-28165 >= 7.2.2, < 9.4.39, >= 10.0.0, < 10.0.2, >= 11.0.0, < 11.0.2 9.4.39, 10.0.2, 11.0.2
05.08.2020

Operation on a Resource after Expiration or Release in Jetty Server

Krytyczna · 9.4 CVE-2019-17638 >= 9.4.27, < 9.4.30.v20200611 9.4.30.v20200611
28.03.2019

Uncontrolled Resource Consumption in org.eclipse.jetty:jetty-server

Wysoka · 7.5 CVE-2018-12545 >= 9.4.0, < 9.4.12.v20180830, >= 9.3.0, < 9.3.25.v20180904 9.4.12.v20180830, 9.3.25.v20180904
09.11.2018

Jetty vulnerable to exposure of sensitive information to unauthenticated remote users

Wysoka · 7.5 CVE-2015-2080 < 9.2.9.v20150224 9.2.9.v20150224
19.10.2018

Jetty vulnerable to authorization bypass due to inconsistent HTTP request handling (HTTP Request Smuggling)

Krytyczna · 9.8 CVE-2017-7658 < 9.2.25.v20180606, >= 9.3.0, < 9.3.24.v20180605, >= 9.4.0, < 9.4.11.v20180605 9.2.25.v20180606, 9.3.24.v20180605, 9.4.11.v20180605
19.10.2018

Jetty vulnerable to cache poisoning due to inconsistent HTTP request handling (HTTP Request Smuggling)

Wysoka · 7.5 CVE-2017-7656 < 9.3.24.v20180605, >= 9.4.0, < 9.4.11.v20180605 9.3.24.v20180605, 9.4.11.v20180605
19.10.2018

Jetty contains an alias issue that could allow unauthenticated remote code execution due to specially crafted request

Krytyczna · 9.8 CVE-2016-4800 >= 9.3.0, < 9.3.9 9.3.9
19.10.2018

Jetty vulnerable to exposure of sensitive information due to observable discrepancy

Wysoka · 7.5 CVE-2017-9735 >= 9.4.0, < 9.4.6.v20170531, >= 9.3.0, < 9.3.20.v20170531, < 9.2.22.v20170606 9.4.6.v20170531, 9.3.20.v20170531, 9.2.22.v20170606
19.10.2018

Critical severity vulnerability that affects org.eclipse.jetty:jetty-server

Krytyczna · 9.8 CVE-2017-7657 < 9.2.25.v20180606, >= 9.3.0, < 9.3.24.v20180605 9.2.25.v20180606, 9.3.24.v20180605
16.10.2018

Access and integrity issue within Eclipse Jetty

Wysoka · 8.8 CVE-2018-12538 >= 9.4.0, < 9.4.11.v20180605 9.4.11.v20180605

Dowiedz się, które podatności dotyczą Twojej aplikacji

Po podłączeniu integracji DockRay i włączeniu raportowania oprogramowania DockRay porównuje zgłoszone wersje komponentów ze znanymi podatnościami i powiadamia o potwierdzonych dopasowaniach. Zakres zależy od obsługiwanej technologii i dostępnych biuletynów.

Podłącz swoją aplikację