Track vulnerabilities like this one.
Sign up free to get alerted when software you use is affected.
7.8
CVE-2026-10051: Jetty server may mix HTTP headers across requests
CVE-2026-10051 · published 3 months ago
Summary
The Jetty web server can keep the extra information (trailers) from the first HTTP request and mistakenly attach it to later requests on the same connection. This could cause the server to process incorrect data or expose internal details. Update Jetty to the latest version or apply the vendor's patches to stop the trailer information from being reused.
What to do
- Update eclipse org.eclipse.jetty:jetty-server to version 12.0.36.
- Update eclipse org.eclipse.jetty:jetty-server to version 12.1.10.
- Update root io.root.org.eclipse.jetty:jetty-server to version 12.0.3-root.io.8.
- Update eclipse org.eclipse.jetty:jetty-server to version 12.0.3-aikido.8.
- Update root io.root.org.eclipse.jetty:jetty-server to version 12.0.33-root.io.2.
- Update eclipse org.eclipse.jetty:jetty-server to version 12.0.33-aikido.2.
- Update root io.root.org.eclipse.jetty:jetty-server to version 12.0.13-root.io.10.
- Update eclipse org.eclipse.jetty:jetty-server to version 12.0.13-aikido.10.
- Update root io.root.org.eclipse.jetty:jetty-server to version 12.0.16-root.io.5.
- Update eclipse org.eclipse.jetty:jetty-server to version 12.0.16-aikido.5.
- Update root io.root.org.eclipse.jetty:jetty-server to version 12.0.3-root.io.9.
- Update eclipse org.eclipse.jetty:jetty-server to version 12.0.3-aikido.9.
- Update org.eclipse.jetty:jetty-server to version 12.0.33-aikido.3.
- Update io.root.org.eclipse.jetty:jetty-server to version 12.0.33-root.io.3.
- Update debian jetty12 to version 12.0.39-1.
Affected software
| Ecosystem | Vendor | Product | Affected versions |
|---|---|---|---|
| – | eclipse foundation | eclipse jetty | <= 12.0.35 |
| – | eclipse | jetty |
>= 12.0.0, < 12.0.36 >= 12.1.0, < 12.1.10 cpe:2.3:a:eclipse:jetty:*:*:*:*:*:*:*:* |
| maven | eclipse | org.eclipse.jetty:jetty-server |
>= 12.0.0, <= 12.0.35 >= 12.1.0, <= 12.1.9 Fix: upgrade to 12.0.36
|
| Maven | eclipse | org.eclipse.jetty:jetty-server |
>= 12.0.0, < 12.0.36 >= 12.1.0, < 12.1.10 Fix: upgrade to 12.0.36
|
| Debian:13 | debian | jetty12 | All versions |
| Debian:14 | debian | jetty12 |
< 12.0.39-1 Fix: upgrade to 12.0.39-1
|
| Debian:11 | debian | jetty9 | All versions |
| Debian:12 | debian | jetty9 | All versions |
| Debian:13 | debian | jetty9 | All versions |
| Debian:14 | debian | jetty9 | All versions |
| Root:Maven | root | io.root.org.eclipse.jetty:jetty-server |
< 12.0.3-root.io.8 < 12.0.33-root.io.2 < 12.0.13-root.io.10 < 12.0.16-root.io.5 < 12.0.3-root.io.9 Fix: upgrade to 12.0.3-root.io.8
|
| Root:Maven | eclipse | org.eclipse.jetty:jetty-server |
< 12.0.3-aikido.8 < 12.0.33-aikido.2 < 12.0.13-aikido.10 < 12.0.16-aikido.5 < 12.0.3-aikido.9 Fix: upgrade to 12.0.3-aikido.8
|
| Ubuntu:16.04:LTS | canonical | jetty9 | All versions |
| Ubuntu:18.04:LTS | canonical | jetty9 | All versions |
| Ubuntu:20.04:LTS | canonical | jetty9 | All versions |
| Ubuntu:22.04:LTS | canonical | jetty9 | All versions |
| Ubuntu:24.04:LTS | canonical | jetty9 | All versions |
| Ubuntu:26.04:LTS | canonical | jetty12 | All versions |
| Ubuntu:26.04:LTS | canonical | jetty9 | All versions |
| Root:Maven | – | org.eclipse.jetty:jetty-server |
< 12.0.33-aikido.3 Fix: upgrade to 12.0.33-aikido.3
|
| Root:Maven | – | io.root.org.eclipse.jetty:jetty-server |
< 12.0.33-root.io.3 Fix: upgrade to 12.0.33-root.io.3
|
Original advisory text
CVE-2026-10051 in org.eclipse.jetty:jetty-server - Patched by Root
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection. Subsequent request that do not have trailers report the trailers of the first request. Subsequent request that do have trailers report the union of trailers of the first request and the current request.
References
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119 URL
- https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2
- https://github.com/jetty/jetty.project/pull/15162
- https://github.com/jetty/jetty.project/pull/15163
- https://github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff...
- https://github.com/advisories/GHSA-f4v5-65jj-pcr2
- https://github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6...
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10
- https://ubuntu.com/security/CVE-2026-10051 Third Party Advisory
- https://www.cve.org/CVERecord?id=CVE-2026-10051 Third Party Advisory
- https://nvd.nist.gov/vuln/detail/CVE-2026-10051 Vendor Advisory
- https://github.com/CVEProject/cvelistV5/tree/main/cves/2026/10xxx/CVE-2026-10051... Vendor Advisory
- https://github.com/jetty/jetty.project Product
- https://security-tracker.debian.org/tracker/CVE-2026-10051 Vendor Advisory
Internet-facing
14 days
Internal
60 days
- Not known to be exploited
- Can be exploited automatically
- Gives an attacker partial control
Type
CWE-200Information Exposure
Timeline
Published14 Jul 2026
Updated4 Nov 2026
First seen14 Jul 2026
Sources
DEBIAN-CVE-2026-10051 · OSV
UBUNTU-CVE-2026-10051 · OSV
CVE-2026-10051 · NVD
CVE-2026-10051 · MITRE
GHSA-f4v5-65jj-pcr2 · GHSA
GHSA-f4v5-65jj-pcr2 · OSV
CVE-2026-10051 · OSV
Track software like this
Free during beta