PT-2026-23445 · Eclipse · Eclipse Jetty

Gleb Sizov · Publicado 2026-03-05 · Atualizado 2026-05-31 · CVE-2026-1605

Positive Technologies (AI Summary) · Pt

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Nome do Software Vulnerável e Versões Afetadas Versões do Eclipse Jetty 12.0.0 a 12.0.31 Versões do Eclipse Jetty 12.1.0 a 12.1.5

Descrição A classe GzipHandler do Eclipse Jetty apresenta um problema no qual ocorre um vazamento de memória ao processar uma requisição HTTP compactada (Content-Encoding: gzip) sem uma resposta compactada correspondente. O Inflater do JDK é alocado para descompressão, mas não é liberado, pois o mecanismo de liberação está vinculado à resposta compactada. Como nenhuma resposta compactada é enviada, o mecanismo de liberação não é ativado, resultando em um vazamento de memória.

Recomendações Atualize o Eclipse Jetty para uma versão posterior à 12.0.31. Atualize o Eclipse Jetty para uma versão posterior à 12.1.5.

Correção

Memory Leak

Resource Exhaustion

Enumeração de Fraquezas

CWE-401

CWE-400

Identificadores relacionados

CLEANSTART-2026-AO61361

CLEANSTART-2026-AV84730

CLEANSTART-2026-DC73689

CLEANSTART-2026-DO09088

CLEANSTART-2026-DS86833

CLEANSTART-2026-DY69070

CLEANSTART-2026-GM79879

CLEANSTART-2026-GN46454

CLEANSTART-2026-GQ14179

CLEANSTART-2026-HQ78610

CLEANSTART-2026-IA43044

CLEANSTART-2026-KB76878

CLEANSTART-2026-RG24361

CLEANSTART-2026-RM01950

CLEANSTART-2026-SR31778

CLEANSTART-2026-TK07726

CLEANSTART-2026-VN28553

CVE-2026-1605

GHSA-XXH7-FCF3-RJ7F

Produtos afetados

Eclipse Jetty

Referências · 180

• https://github.com/jetty/jetty.project/security/advisories/GHSA-xxh7-fcf3-rj7f · Aviso do Fabricante
• https://github.com/jetty/jetty.project · Nota
• https://github.com/jetty/jetty.project/issues/14260 · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-HQ78610.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DO09088.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AO61361.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-DC73689.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-KB76878.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-GN46454.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-TK07726.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-VN28553.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RM01950.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-RG24361.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-SR31778.json · Nota
• https://github.com/cleanstart-dev/cleanstart-security-advisories/tree/main/advisories/2026/CLEANSTART-2026-AV84730.json · Nota