Log in Start free

Vulnerability · Published Sep 8, 2026 · Assigned by eclipse

CVE-2026-12611

High 8.7

In plain English

A high-severity uncontrolled resource consumption in Eclipse Jetty from Eclipse Foundation. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 0.4% (higher than 37% of all known vulnerabilities). Fixed versions are available - upgrade the affected package.

Severity (CVSS 4.0)8.7High
Exploit odds (30 days)0.4%top 62.8% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A client may issue HTTP/2 requests to a Jetty server that result in blocking writes that are never unblocked, eventually causing all threads to be blocked and the whole server to become unresponsive. This is caused by a race condition in the server when handling RST_STREAM frames and GOAWAY frames sent by the client. The race condition "resets" the HTTP2Flusher.terminated, previously set to a non-null value, to the null value, allowing entries to be enqueued in the flusher that however will never be processed. These unprocessed entries are the ones that would unblock the write-blocked threads.

Affected packages & fixed versions

EcosystemPackageFixed inAdvisory
Debian:13jetty12no fix listedDEBIAN-CVE-2026-12611
Debian:14jetty1212.0.39-1DEBIAN-CVE-2026-12611
Debian:12jetty9no fix listedDEBIAN-CVE-2026-12611
Debian:13jetty9no fix listedDEBIAN-CVE-2026-12611
Debian:14jetty9no fix listedDEBIAN-CVE-2026-12611
Ubuntu:26.04:LTSjetty12no fix listedUBUNTU-CVE-2026-12611
Ubuntu:26.10jetty12no fix listedUBUNTU-CVE-2026-12611
Ubuntu:22.04:LTSjetty9no fix listedUBUNTU-CVE-2026-12611
Ubuntu:24.04:LTSjetty9no fix listedUBUNTU-CVE-2026-12611
Ubuntu:26.04:LTSjetty9no fix listedUBUNTU-CVE-2026-12611
Ubuntu:26.10jetty9no fix listedUBUNTU-CVE-2026-12611

Affected products (as reported)

VendorProductVersions
Eclipse Foundation Eclipse Jetty 12.1.0 – through 12.1.1012.0.0 – through 12.0.3711.00 – through 11.0.3110.0.0 – through 10.0.319.4.36 – through 9.4.63

Weakness: CWE-400 · Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N

References