Skip to content
fr Sign in
7.5 High

CVE-2026-1605 In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed…

Description

In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.

Affected products and versions

Product Affected versions Fixed in
Red Hat JBoss EAP 8.1 for RHEL 8 Versions not published
Red Hat JBoss EAP 8.1 for RHEL 9 Versions not published
HawtIO HawtIO 4.4.0 Versions not published
Red Hat AMQ Broker 7.14.0 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 Versions not published
Red Hat OpenShift Dev Spaces 3.28 1779359423 earliest → < 1779359423 1779359423
OpenShift Developer Tools and Services Versions not published
Red Hat build of Apache Camel for Spring Boot 4 Versions not published
Red Hat build of Apicurio Registry 2 Versions not published
Show the 32 other branches
Product Affected versions Fixed in
Red Hat build of Apicurio Registry 3 Versions not published
Red Hat build of Debezium 2 Versions not published
Red Hat build of Debezium 3 Versions not published
Red Hat Data Grid 8 Versions not published
Red Hat Enterprise Linux 7 Versions not published
Red Hat Enterprise Linux 8 Versions not published
Red Hat Enterprise Linux 9 Versions not published
Red Hat Fuse 7 Versions not published
Red Hat JBoss Enterprise Application Platform 7 Versions not published
Red Hat JBoss Enterprise Application Platform Expansion Pack Versions not published
Red Hat JBoss Web Server 6 Versions not published
Red Hat Offline Knowledge Portal Versions not published
Red Hat Process Automation 7 Versions not published
Red Hat Satellite 6 Versions not published
Red Hat Single Sign-On 7 Versions not published
streams for Apache Kafka 2 Versions not published
streams for Apache Kafka 3 Versions not published
Eclipse Jetty 12.1 earliest → 12.1.5 No fix stated
Eclipse Jetty 12.0 12.0.0 → 12.0.31 No fix stated
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 8 Versions not published
Red Hat JBoss Enterprise Application Platform 8.1 for RHEL 9 Versions not published
OpenShift Developer Tools and Services 4.12 1786628667 earliest → < 1786628667 1786628667
OpenShift Developer Tools and Services 4.13 1786628681 earliest → < 1786628681 1786628681
OpenShift Developer Tools and Services 4.14 1786533561 earliest → < 1786533561 1786533561
OpenShift Developer Tools and Services 4.15 1786533565 earliest → < 1786533565 1786533565
OpenShift Developer Tools and Services 4.16 1787125166 earliest → < 1787125166 1787125166
OpenShift Developer Tools and Services 4.17 1787124635 earliest → < 1787124635 1787124635
OpenShift Developer Tools and Services 4.18 1787125069 earliest → < 1787125069 1787125069
OpenShift Developer Tools and Services 4.19 1787124632 earliest → < 1787124632 1787124632
OpenShift Developer Tools and Services 4.20 1787124925 earliest → < 1787124925 1787124925
OpenShift Developer Tools and Services 4.21 1787125311 earliest → < 1787125311 1787125311
OpenShift Developer Tools and Services 4.22 1787124779 earliest → < 1787124779 1787124779

References

Timeline

  1. Published
  2. Last modified

Other CVEs of Red Hat JBoss EAP 8.1 for RHEL 8

The 13 CVEs of Red Hat JBoss EAP 8.1 for RHEL 8 →
CVE-2026-3505 Allocation of resources without limits or throttling, Uncontrolled Resource Consumption vulnerability in Legion of the… 8.7 High CVE-2026-5588 Use of a Broken or Risky Cryptographic Algorithm vulnerability in Legion of the Bouncy Castle Inc 6.3 Medium CVE-2026-5598 Covert timing channel vulnerability in Legion of the Bouncy Castle Inc 8.9 High CVE-2026-0636 Improper neutralization of special elements used in an LDAP query ('LDAP injection') vulnerability in Legion of the… 5.5 Medium
Track this CVE