DEBIAN-CVE-2026-1605
In Eclipse Jetty, versions 12.0.0-12.0.31 and 12.1.0-12.0.5, class GzipHandler exposes a vulnerability when a compressed HTTP request, with Content-Encoding: gzip, is processed and the corresponding response is not compressed. This happens because the JDK Inflater is allocated for decompressing the request, but it is not released because the release mechanism is tied to the compressed response. In this case, since the response is not compressed, the release mechanism does not trigger, causing the leak.
DEBIAN-CVE-2026-1605
Primary source · Revision 1
Imported from structured advisory data. Source references identify upstream records or fields; verify affected versions and your deployed configuration.
Security context
Source reference: osv:DEBIAN-CVE-2026-1605
jetty12
Source reference: /affected/0/package/name
- Affected versions
- 12.0.17-3
Source reference:
/affected/0/versions12.0.17-3.1Source reference:
/affected/0/versions12.0.17-3.1~deb13u1Source reference:
/affected/0/versions12.0.32-1Source reference:
/affected/0/versions12.0.32-2Source reference:
/affected/0/versions12.0.33-1Source reference:
/affected/0/versions12.0.39-1Source reference:
/affected/0/versions - Fixed versions
- Not stated in this record
- Prerequisites
- Not stated in this record
jetty12
Source reference: /affected/1/package/name
- Affected versions
- 12.0.17-3
Source reference:
/affected/1/versions12.0.17-3.1Source reference:
/affected/1/versions12.0.17-3.1~deb13u1Source reference:
/affected/1/versions - Fixed versions
- 12.0.32-1
Source reference:
/affected/1/ranges - Prerequisites
- Not stated in this record
Structured affected-version data
Original package identities and version rules from this source.
[
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
}
]
}
],
"package": {
"name": "jetty12",
"purl": "pkg:deb/debian/jetty12?arch=source&distro=trixie",
"ecosystem": "Debian:13"
},
"versions": [
"12.0.17-3",
"12.0.17-3.1",
"12.0.17-3.1~deb13u1",
"12.0.32-1",
"12.0.32-2",
"12.0.33-1",
"12.0.39-1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-1605.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
},
{
"ranges": [
{
"type": "ECOSYSTEM",
"events": [
{
"introduced": "0"
},
{
"fixed": "12.0.32-1"
}
]
}
],
"package": {
"name": "jetty12",
"purl": "pkg:deb/debian/jetty12?arch=source&distro=forky",
"ecosystem": "Debian:14"
},
"versions": [
"12.0.17-3",
"12.0.17-3.1",
"12.0.17-3.1~deb13u1"
],
"database_specific": {
"source": "https://storage.googleapis.com/debian-osv/debian-cve-osv/DEBIAN-CVE-2026-1605.json"
},
"ecosystem_specific": {
"urgency": "not yet assigned"
}
}
]Publisher severity
No explicit severity was provided.
- Event
- #55544 · Revision 1
- Added to Heist Feed
- Publisher date