Maven/org.eclipse.jetty:jetty-server CVE-2026-10051: high 7.5, EPSS 0.43%
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
Action: Upgrade org.eclipse.jetty:jetty-server to 12.0.36 (12.0.x) or 12.1.10 (12.1.x) or later.
Affected
| introduced | fixed | last affected |
|---|---|---|
| 12.0.0 | 12.0.36 | - |
| 12.1.0 | 12.1.10 | - |
Fixed versions
| 12.0.36 | 12.1.10 |
Sources
- osv: GHSA-f4v5-65jj-pcr2
- nvd: CVE-2026-10051
- https://github.com/jetty/jetty.project/security/advisories/GHSA-f4v5-65jj-pcr2
- https://github.com/jetty/jetty.project/pull/15162
- https://github.com/jetty/jetty.project/pull/15163
- https://github.com/jetty/jetty.project/commit/72206b3ea623cf7ed8729b47a83ee628ff10e8eb
- https://github.com/jetty/jetty.project/commit/dc27e8d3ab743fe27935ea2d8c41756eb6c5bae9
- https://github.com/jetty/jetty.project
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.0.36
- https://github.com/jetty/jetty.project/releases/tag/jetty-12.1.10
- https://gitlab.eclipse.org/security/cve-assignment/-/work_items/119
CVE-2026-10051 · published · modified · JSON