CVE-2026-10051
published 2026-07-14CVE-2026-10051: In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection…
PriorityP346high7.5CVSS 3.1
AVNACLPRNUINSUCHINAN
EPSS
0.30%
21.8th percentile
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
Subsequent request that do not have trailers report the trailers of the first request.
Subsequent request that do have trailers report the union of trailers of the first request and the current request.
Affected
21 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | puppetserver | — | — |
| devspaces | openvsx-rhel9 | — | — |
| devspaces | pluginregistry-rhel9 | — | — |
| eclipse | jetty | >= 12.0.0 < 12.0.36 | 12.0.36 |
| eclipse | jetty | >= 12.1.0 < 12.1.10 | 12.1.10 |
| eclipse_foundation | eclipse_jetty | 12.0.0 – 12.0.35 | — |
| eclipse_foundation | eclipse_jetty | 12.1.0 – 12.1.9 | — |
| jenkins | jenkins | — | — |
| ocp-tools-4 | jenkins-rhel8 | — | — |
| ocp-tools-4 | jenkins-rhel9 | — | — |
| offline-knowledge-portal | rhokp-rhel9 | — | — |
| pki-core_10.6 | resteasy | — | — |
| pki-deps_10.6 | resteasy | — | — |
| redhat | resteasy | — | — |
| rhoai | odh-spark-operator-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cpu-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch210-py312-rhel9 | — | — |
| rhoai | odh-th06-cuda130-torch291-py312-rhel9 | — | — |
| rhoai | odh-th06-rocm64-torch291-py312-rhel9 | — | — |
| satellite_el8 | puppetserver | — | — |
CVSS provenance
nvdv3.17.5HIGHCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
nvdv4.06.9MEDIUMCVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
vendor_redhat7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
ghsa·2026-07-22
CVE-2026-10051 [MEDIUM] CWE-200 Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
Eclipse Jetty: Cross-Request Leakage for trailers on HTTP/1.1 keep-alive connections
### Description
> FINDING — MEDIUM (HTTP/1.1 keep-alive connections with trailers)
> HttpConnection._trailers Cross-Request Leakage (Never Reset Between Requests)
>
> Location:
> jetty-core/jetty-server/src/main/java/org/eclipse/jetty/server/internal/
> HttpConnection.java:107, 1157-1161, 1170
>
> Detail:
> _trailers (line 107) is a connection-scoped HttpFields.Mutable field.
> parsedTrailer() (line 1157) populates it when request N carries HTTP trailers.
> messageComplete() (line 1170) checks "if (_trailers != null)" — evaluates true
> from request N's data — and stamps it onto request N+1.
>
> Grep confirms: ZERO occurrences of "_trailers = null" in entire HttpConnection.java.
>
> Scenario:
> Request N
VulDB
Eclipse Jetty up to 12.0.35/12.1.9 Connection cross-site request forgery (WID-SEC-2026-2314)
vuldb·2026-07-14·CVSS 7.5
CVE-2026-10051 [HIGH] Eclipse Jetty up to 12.0.35/12.1.9 Connection cross-site request forgery (WID-SEC-2026-2314)
A vulnerability classified as problematic has been found in Eclipse Jetty up to 12.0.35/12.1.9. Affected by this vulnerability is an unknown functionality of the component Connection. Performing a manipulation results in cross-site request forgery.
This vulnerability is cataloged as CVE-2026-10051. It is possible to initiate the attack remotely. There is no exploit available.
Red Hat
jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
vendor_redhat·2026-07-14·CVSS 7.5
CVE-2026-10051 [HIGH] CWE-201 jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
Subsequent request that do not have trailers report the trailers of the first request.
Subsequent request that do have trailers report the union of trailers of the first request and the current request.
A flaw was found in Eclipse Jetty. This vulnerability allows a remote attacker to cause the server to retain HTTP/1.1 request trailers from a prior connection. Consequently, subsequent requests made over the same connection may unintentionally disclose information by reporting the previously retained trailers, or a combination of previous
No detection rules found.
No public exploits indexed.
Bugzilla
CVE-2026-10051 resteasy: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections [fedora-all]
bugzilla·2026-08-05·CVSS 7.5
CVE-2026-10051 [HIGH] CVE-2026-10051 resteasy: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections [fedora-all]
CVE-2026-10051 resteasy: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
Subsequent request that do not have trailers report the trailers of the first request.
Subsequent request that do have trailers report the union of trailers of the first request and the current request.
Bugzilla
CVE-2026-10051 python-avro: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections [fedora-all]
bugzilla·2026-08-05·CVSS 7.5
CVE-2026-10051 [HIGH] CVE-2026-10051 python-avro: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections [fedora-all]
CVE-2026-10051 python-avro: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
Subsequent request that do not have trailers report the trailers of the first request.
Subsequent request that do have trailers report the union of trailers of the first request and the current request.
Bugzilla
CVE-2026-10051 maven4: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections [fedora-all]
bugzilla·2026-08-05·CVSS 7.5
CVE-2026-10051 [HIGH] CVE-2026-10051 maven4: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections [fedora-all]
CVE-2026-10051 maven4: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections [fedora-all]
Disclaimer: Community trackers are created by Red Hat Product Security team on a best effort basis. Package maintainers are required to ascertain if the flaw indeed affects their package, before starting the update process.
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
Subsequent request that do not have trailers report the trailers of the first request.
Subsequent request that do have trailers report the union of trailers of the first request and the current request.
Bugzilla
CVE-2026-10051 jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
bugzilla·2026-07-14·CVSS 7.5
CVE-2026-10051 [HIGH] CVE-2026-10051 jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
CVE-2026-10051 jetty: Eclipse Jetty: Information disclosure due to retained HTTP/1.1 trailers across connections
In Eclipse Jetty, a first HTTP/1.1 request with trailers causes the server to retain the trailers in subsequent requests performed over the same connection.
Subsequent request that do not have trailers report the trailers of the first request.
Subsequent request that do have trailers report the union of trailers of the first request and the current request.
2026-07-14
Published